ldm-session-handoff

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python and Node.js scripts (scripts/export_transcript.py, scripts/export_jsonl_transcript.py, scripts/export_workbuddy_transcript.py, and scripts/export_dsh_session.js) to read local session history from established application directories (e.g., ~/.hermes, ~/.claude, ~/.workbuddy-ai). These operations are consistent with the skill's stated purpose of exporting chat logs.
  • [DATA_EXPOSURE]: While the skill accesses sensitive session history files, it does so to perform a local export requested by the user. There is no evidence of the data being transmitted to unauthorized external domains. Network operations are not present in the provided scripts.
  • [DYNAMIC_EXECUTION]: The skill includes a Node.js script (scripts/export_dsh_session.js) that uses zlib to decompress zstd-compressed session files. This is a legitimate handling of a specific file format used by the DeepSeek Harness (DSH) platform.
  • [PRIVILEGE_ESCAlATION]: The instructions recommend using rsync for synchronization in specific installation scenarios, but do not request sudo or other elevated privileges. It operates within the user's home directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 03:05 AM