Save Claude Notes

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 0.1.0

Overview

This skill has a coherent note-saving purpose, but it reads Claude Code transcripts via automatic discovery and can save the wrong conversation content without clear confirmation.

Install only if you are comfortable with the skill reading local Claude Code transcripts and appending selected Q&A content to Markdown files. Prefer explicit transcript or file-based input for sensitive work, verify the destination path, and avoid using the default --latest mode when multiple projects or private conversations may be present.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:12

Finding

Overbroad Discovery and Access of Claude Code Transcripts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-14 and 24
Vulnerability Type: Sensitive transcript discovery and access beyond a precisely selected conversation
Risk Level: Medium

Relevant Code Snippet:

markdown

Prefer `--latest`; it reads the latest Q&A from the Claude Code transcript so long answers are not repeated in tool input.

`--latest` discovers transcripts from `~/.claude/projects` using the current working directory. If discovery fails or captures the wrong turn, retry with `SAVE_NOTE_CWD="PROJECT_PATH"` or `--transcript PATH` before falling back to explicit content input.

bash

~/.claude/skills/save-claude-notes/scripts/save-claude-notes.sh --latest

Technical Analysis

The skill directs the agent to run an external script that searches the user-wide ~/.claude/projects location and reads conversation transcripts. Selection is inferred from the current working directory rather than requiring the user to identify and approve a specific transcript and turn.

The document explicitly acknowledges that discovery can capture the wrong turn. Consequently, invoking the ordinary --latest workflow may access unrelated or unintended conversation content. Such transcripts can contain private prompts, generated source code, credentials, proprietary information, or context belonging to another project.

The referenced scripts/save-claude-notes.sh implementation is not included in the audited project. Therefore, the audit could not verify its transcript-selection logic, path containment, secret detection, redaction, symbolic-link handling, or output-file validation. No network transmission or deliberate exfiltration instruction was identified in the submitted file.

Attack Path

1. A user invokes /save-claude-notes while the agent is operating in a project directory.
2. The skill instructs the agent to execute save-claude-notes.sh --latest.
3. The external script ...[truncated 1345 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation of the resolved transcript path, project, timestamp, and conversation turn before reading or saving content.
2. Restrict automatic discovery to the active project's canonical transcript directory and reject candidates outside that directory.
3. Resolve and validate canonical paths before access, including checks against path traversal and symbolic-link redirection.
4. Default to explicit transcript and turn selection when discovery is ambiguous rather than silently selecting the latest candidate.
5. Display a redacted preview or metadata-only summary before committing the note.
6. Apply secret detection and redaction by default. Any bypass should require confirmation tied to the specific content and destination.
7. Restrict output files to user-approved note directories unless the user explicitly confirms an alternative canonical path.
8. Include scripts/save-claude-notes.sh in the audited package so its transcript parsing, input validation, file permissions, and output handling can be reviewed.
9. Create note files with restrictive permissions and warn users when the destination is located in a shared or automatically synchronized directory.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

Configure default notes directory

Only when the user asks to change the default directory, write this JSON to ~/.claude/save-claude-notes/config.json:

json

{"notesDir":"TARGET_DIRECTORY"}