read-claude-web-conversation

SUSPICIOUS/medium-risk but not malicious. The skill's powerful browser-automation and private data access are largely consistent with its stated purpose of exporting Claude web conversations, and data stays on official claude.ai/local disk paths. Main concerns are use of undocumented internal APIs, broad browser-context access, and unpinned runtime dependency installation rather than clear signs of credential theft or third-party exfiltration.

No clear evidence of classic malware (e.g., reverse shell, persistence, hardcoded secrets) is shown in the provided excerpt. However, the described workflow is a powerful browser-session data extraction/export pipeline: it injects JavaScript into a user-signed-in Chrome tab via Apple Events, fetches authenticated `/api/...` data and binary downloads, then transports results back through stdout and writes them to local files via base64 decoding. This capability is strongly aligned with data theft/exfiltration patterns and should be treated as security-sensitive until the referenced runner and step implementations and endpoint targeting are fully audited.

No direct indicators of classic malware (persistence, system damage, hidden network exfiltration, or host credential theft) are present in this module. However, it provides high-privilege functionality: arbitrary JavaScript execution in the context of a selected, already-running Chrome tab via CDP Runtime.evaluate, plus the ability to open arbitrary URLs. The security impact is therefore driven by who controls the JS input and target selection; treat this as a powerful browser automation/evaluation tool requiring strict trust boundaries for CLI/file inputs.

No strong indicators of classic malware behavior (e.g., backdoor, remote command execution, or off-site exfiltration) are present in this snippet. The main security concern is high-impact data exposure: it bulk-downloads binaries referenced by conversation/tool data and stores base64-encoded contents in `window.__dl`, making the data retrievable by any in-page JavaScript. Risk is therefore primarily tied to authorization correctness on the referenced API endpoints and to the page’s overall script trust model (what other scripts can access window globals).

This module is primarily a data retrieval/export helper that fetches chat conversation content from same-origin APIs and then publishes the full serialized conversation (rawJson) to window.__claudeExport. While it does not show overt malicious behavior such as external exfiltration, command execution, or obfuscation, exporting complete conversation data to a global variable is a significant client-side sensitive-data exposure risk if any other scripts on the page (or compromised third-party code/extensions) can access window.__claudeExport. The org-iteration loop and expanded rendering parameters increase the likelihood of retrieving more content than strictly needed.