ldm-session-handoff
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python and Node.js scripts (
scripts/export_transcript.py,scripts/export_jsonl_transcript.py,scripts/export_workbuddy_transcript.py, andscripts/export_dsh_session.js) to read local session history from established application directories (e.g.,~/.hermes,~/.claude,~/.workbuddy-ai). These operations are consistent with the skill's stated purpose of exporting chat logs. - [DATA_EXPOSURE]: While the skill accesses sensitive session history files, it does so to perform a local export requested by the user. There is no evidence of the data being transmitted to unauthorized external domains. Network operations are not present in the provided scripts.
- [DYNAMIC_EXECUTION]: The skill includes a Node.js script (
scripts/export_dsh_session.js) that useszlibto decompress zstd-compressed session files. This is a legitimate handling of a specific file format used by the DeepSeek Harness (DSH) platform. - [PRIVILEGE_ESCAlATION]: The instructions recommend using
rsyncfor synchronization in specific installation scenarios, but do not requestsudoor other elevated privileges. It operates within the user's home directory.
Audit Metadata