session-audit

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill instructs reading full session transcripts and local logs and deliberately sending them to an "independent" auditor and to GitHub (via gh) without user prompts or gating, enabling silent/external disclosure of potentially sensitive data.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md Step 1 reads the current session’s JSONL transcript from ~/.claude/projects/<cwd-slug>/<CLAUDE_CODE_SESSION_ID>.jsonl and Step 2 feeds that transcript (including user message strings) to an independent auditor sub-agent, so outsider-authored free text is ingested when it appears in the session transcript.