read-claude-web-conversation

SUSPICIOUS. The skill's behavior mostly matches its stated purpose, and network traffic stays with Claude.ai rather than a third-party exfiltration service. But its purpose itself is highly sensitive: it instructs the agent to inject JS into the user's logged-in browser, access undocumented private APIs, and export complete private transcripts plus attachment contents. That is proportionate to the claimed export task, yet still a medium-high security risk because it operationalizes session-backed extraction of private data and depends on local automation channels, including one unseen helper script.

No clear evidence of classic malware (e.g., reverse shell, persistence, hardcoded secrets) is shown in the provided excerpt. However, the described workflow is a powerful browser-session data extraction/export pipeline: it injects JavaScript into a user-signed-in Chrome tab via Apple Events, fetches authenticated `/api/...` data and binary downloads, then transports results back through stdout and writes them to local files via base64 decoding. This capability is strongly aligned with data theft/exfiltration patterns and should be treated as security-sensitive until the referenced runner and step implementations and endpoint targeting are fully audited.

No direct indicators of classic malware (persistence, system damage, hidden network exfiltration, or host credential theft) are present in this module. However, it provides high-privilege functionality: arbitrary JavaScript execution in the context of a selected, already-running Chrome tab via CDP Runtime.evaluate, plus the ability to open arbitrary URLs. The security impact is therefore driven by who controls the JS input and target selection; treat this as a powerful browser automation/evaluation tool requiring strict trust boundaries for CLI/file inputs.

No strong indicators of classic malware behavior (e.g., backdoor, remote command execution, or off-site exfiltration) are present in this snippet. The main security concern is high-impact data exposure: it bulk-downloads binaries referenced by conversation/tool data and stores base64-encoded contents in `window.__dl`, making the data retrievable by any in-page JavaScript. Risk is therefore primarily tied to authorization correctness on the referenced API endpoints and to the page’s overall script trust model (what other scripts can access window globals).

This module is primarily a data retrieval/export helper that fetches chat conversation content from same-origin APIs and then publishes the full serialized conversation (rawJson) to window.__claudeExport. While it does not show overt malicious behavior such as external exfiltration, command execution, or obfuscation, exporting complete conversation data to a global variable is a significant client-side sensitive-data exposure risk if any other scripts on the page (or compromised third-party code/extensions) can access window.__claudeExport. The org-iteration loop and expanded rendering parameters increase the likelihood of retrieving more content than strictly needed.