session-share
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill reads from and writes to ~/.claude/projects/, which contains sensitive Claude session history including conversation logs, code snippets, and potentially user-entered secrets. While the export script includes a redaction routine to strip keys and home paths, the regex-based logic is not exhaustive and may leave sensitive data exposed in the generated files.
- [COMMAND_EXECUTION]: Local bash scripts are used to manage the file system and interact with session control tools. These scripts perform operations directly within sensitive application data directories and handle external session data.
- [PROMPT_INJECTION]: The import functionality introduces an indirect prompt injection surface by ingesting message history from external files into the agent's active context. If an imported session file is maliciously crafted, it could contain instructions that hijack the agent's behavior when the session is resumed.
- Ingestion points: The scripts/import.sh script loads messages from user-provided JSON files.
- Boundary markers: No delimiters or instruction-ignoring warnings are implemented for the imported content.
- Capability inventory: The agent maintains full access to its standard toolset and project files in the resumed session.
- Sanitization: No content verification or filtering is applied to the conversation messages during the import process.
Audit Metadata