export-chat-history

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires reading local session files and exporting/uploading their raw contents to a GitHub Gist (and generating summaries from those contents), which forces the agent to handle — and may cause it to output or transmit — any API keys, tokens, or passwords contained verbatim in those sessions.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill explicitly automates collecting local chat session data (user messages, metadata, cwd/branch, etc.) and then unpromptedly uploads the export to GitHub Gist ("Always create a private gist without asking"), which is deliberate data exfiltration of potentially sensitive information.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). Outsider free text is ingested from Cursor session transcript files (~/.cursor/projects/{project-name}/agent-transcripts/*.txt) which are authored by other people in the chat history; the workflow reads them as plain text via cat "$SESSION_FILE" / txt_file.read_text() and then includes that content in the LLM context for title/description generation.