ClawHub
Back to skill

Security audit

cross-session-passphrase

Security checks for vulnerabilities and agentic risk

Overview

The skill openly describes a cross-session passphrase system, but its memory-backed automatic file-reading and relaying behavior is too broad and under-controlled for routine installation.

Install only if you intentionally want persistent same-account cross-session handoff behavior. Before using it, require each receiving session to confirm the exact file or data to read, avoid registering broad passphrases, and remove any MEMORY.md mappings that could trigger automatic disclosure later.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The manifest advertises many broad natural-language trigger phrases such as asking what another session did or to let another window read a file. Broad triggers increase the chance that ordinary conversation activates cross-session behaviors unexpectedly, which can cause unintended disclosure or action relay between sessions. In this skill’s context, the danger is higher because the triggers are tied to memory-backed command mappings and file-reading behavior.

Ssd 3

High
Confidence
98% confidence
Finding
The description explicitly proposes storing trigger-to-action mappings in user-level MEMORY.md so that another session, upon seeing a passphrase, will automatically execute actions such as reading files and restating their contents. This creates a cross-session command-and-data relay channel that can bypass normal per-session intent validation, enabling unauthorized file access, disclosure of sensitive workspace data, and confused-deputy behavior. The skill context makes this especially dangerous because it is designed specifically to transfer conclusions and file contents between parallel sessions.

Ssd 4

Medium
Confidence
90% confidence
Finding
The manifest frames the mechanism as a verifiable registration and identity-anchor process, which can lend false legitimacy to cross-session command relay and information disclosure. That trust narrative increases the likelihood that users or downstream agents will accept relayed instructions or sensitive summaries without re-validating authority, facilitating social-engineering-style misuse and unsafe disclosure across sessions.

Static analysis

No suspicious patterns detected.