export-conversation
Audited by Socket on Mar 6, 2026
1 alert found:
Obfuscated FileThe export-conversation skill is functionally benign and fits its described purpose: gather conversation history, supplement with limited git metadata, format a Markdown export, and write it to disk. No direct malicious code patterns, network exfiltration steps, or hardcoded secrets are present. Primary risks are operational: accidental export of sensitive or hidden prompts from conversation memory and overly-broad filesystem access when reading git metadata or writing the file. Implementations should (1) restrict git reads to minimal metadata, (2) detect and confirm before exporting likely secrets or system prompts, and (3) validate destination paths and overwrite behavior. With these precautions the skill can be used safely.