Publish Session Name Sync

• Analyzed: May 13, 2026, 9:41 AM
• Findings: 1
• Version: 1.0.0
• Hash: 95d58114cc7b047ca00e10b6bd72f59ce57f441e198bd13e9c7919f7c84d82e8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill synchronizes session names by executing Python scripts and shell commands that modify Claude Code session logs (~/.claude/*.jsonl) and cc-connect configuration files (~/.cc-connect/*.json). It performs high-risk operations in SKILL.md, including terminating and restarting the cc-connect daemon (kill/pgrep) and injecting dummy history entries into session files. The skill is also vulnerable to shell injection because it instructs the agent to interpolate user-controlled variables like ${NAME} directly into python3 -c shell commands without sanitization. While the behavior is aligned with its stated purpose, the aggressive process management and insecure command construction represent significant security risks.