account-rotation
Warn
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: Accesses and modifies sensitive authentication files including
~/.claude/.credentials.jsonand~/.claude.jsonto swap session tokens and user identity blocks between accounts. - [CREDENTIALS_UNSAFE]: Programmatically interacts with the macOS Keychain (
securityserviceClaude Code-credentials) to manage and rotate authentication tokens. - [COMMAND_EXECUTION]: Executes the macOS
securityutility with the-Aflag (security add/delete-generic-password -A), which allows the skill to modify or delete keychain items without triggering a GUI security prompt or requiring manual user approval.
Audit Metadata