trace

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill intentionally mines local session transcripts and project files and explicitly logs/commits those findings to an external "Oracle MCP" (arra_trace), which constitutes deliberate data exfiltration of potentially sensitive content.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The /trace --deep --dig workflow runs dig.py which reads locally stored Claude Code session .jsonl contents (user/outsider-authored via prior requests) and extracts their free-text prompts/summaries into the LLM-visible trace log.