Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

Agent skill · Audited from source

Docs

skill · jazzyalex/agent-sessionsMIT licenceAudited 20 Oct 2026 · source c5afa9b5ffe9

★ 906pushed today
✕BLOCKGrade D · 69/100 · 25 findings · c5afa9b
906repo stars · whole jazzyalex/agent-sessions
Read the findingsView source on GitHub ↗

Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit c5afa9b5ffe9 and observed network access and no hard-coded secrets. The audit raised 25 findings, 3 critical or high. What it does: Local-first macOS app to browse, search, analyze, and resume supported AI coding-agent session history across Codex, Claude Code, OpenCode, Cursor Agent, Antigravity, Hermes, OpenClaw, Copilot CLI, and more.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “Docs (jazzyalex/agent-sessions)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/jazzyalex/docs

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 3 critical or high findings, starting with “Supply chain” in agent-support/agent-support-ledger.yml:1030. Do not install it without reading them.

8 skills are called “Docs”. You are viewing jazzyalex/agent-sessions. 1 of them is BLOCK.

and 3 more with this name.

Trust audit

Audit 0.4.1 · source read 20 Oct 2026

Trust score69/100✕BLOCK D
0 critical3 high3 medium9 low17 info

BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkDeclared1 observation
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityWARN6
L1 Static sourceSecrets, path traversal, supply chain, hidden codeFAIL5
L2 InstructionsPrompt injection, authority framing, hidden directivesFAIL13
L3 InventoryThe files and declarations match the sourceWARN1
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (25)

HIGHSupply chainsupply.pipe_to_shell · agent-support/agent-support-ledger.yml:1030
F-08 Supply chainCWE-829 · CWE-1357Layer L1
- "CLI refresh 2026-06-26: updated Copilot 1.0.24-cask/1.0.64-running->1.0.65 (brew upgrade --cask copilot-cli), OpenClaw active ~/.npm-global install 2026.5.28->2026.6.10 (npm install -g openclaw@lat
Why
remote content executed unseen
Fix
download, verify a checksum, then run
HIGHPrompt injectionprompt.tool_poisoning · backlog.md:1202
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Those 6 begin `# AGENTS.md instructions` / `<INSTRUCTIONS>`, which
Why
a tool description carrying instructions to the agent
Fix
tool descriptions describe the tool; nothing else
HIGHPrompt injectionprompt.tool_poisoning · superpowers/plans/2026-07-13-runway-presentations-phase1.md:373
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
IMPORTANT: when weekly falls back to token, the rows are tk/h but `baseline.rateUnit` is `.weeklyPercentPerHour` → rendering would mislabel. Fix: when falling back, return a snapshot whose baseline ra
Why
a tool description carrying instructions to the agent
Fix
tool descriptions describe the tool; nothing else
MEDIUMPrompt injectionprompt.hidden_style · superpowers/plans/2026-07-09-the-rollout-blog-implementation.md:301
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
<span>• macOS • Open Source • <span id="github-stars-container" style="display:none;">⭐ <span
Why
No further detail recorded for this rule.
Fix
—
MEDIUMInventory / provenanceskill.no_skill_md
F-13 Inventory / provenanceCWE-1104Layer L3
Why
no SKILL.md at the audited path
Fix
a skill without its instruction file cannot be reviewed as one
LOWNetwork egressnet.raw_ip · superpowers/plans/2026-07-09-the-rollout-blog-implementation.md:39
F-04 Network egressCWE-200 · CWE-319Layer L1
6. **`baseurl` is safe for existing pages, load-bearing for new ones.** Existing pages are static-copied, so their hardcoded `https://jazzyalex.github.io/agent-sessions/...` and `../assets/...` links
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · superpowers/plans/2026-07-09-the-rollout-blog-implementation.md:484
F-04 Network egressCWE-200 · CWE-319Layer L1
Tell the owner to open `http://127.0.0.1:4000/agent-sessions/blog/` and the smoke post, and confirm it reads like a guide page (header, type, spacing). Stop the server after.
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · superpowers/plans/2026-07-09-the-rollout-blog-implementation.md:768
F-04 Network egressCWE-200 · CWE-319Layer L1
Serve locally (`bundle exec jekyll serve`, URL `http://127.0.0.1:4000/agent-sessions/blog/`) and get an explicit GO from the owner on the rendered post, index, and nav.
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · superpowers/specs/2026-07-07-runway-auth-health-design.md:277
F-04 Network egressCWE-200 · CWE-319Layer L1
`http://127.0.0.1:<port>/callback`), the shape the CLIs use.
Why
No further detail recorded for this rule.
Fix
—
LOWPrompt injectionprompt.transfer_instruction · CHANGELOG.md:146
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- Fixed Claude Session Runway pricing when transcripts report inference geography as unavailable or empty. These provider states now use published standard rates while explicit US inference keeps its
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · CHANGELOG.md:228
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- **fx (vercel-labs) sessions.** Per-session checkpoints under `~/.fx/sessions`, with every kind of turn rendered — background commands, auto-compaction summaries, interrupted turns. `fx --resume <id>
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · _posts/2026-10-08-session-bench-v1.md:1170
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- [The report](https://github.com/jazzyalex/session-bench/blob/main/artifacts/survival-v1-release/REPORT.md)
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · agent-json-tracking.md:114
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
**THE "VENDOR OUTAGE" WAS OURS.** OpenCode's driver kept returning `UnknownError: Unexpected server error` with a fresh ref each run, and the first pass recorded that as a provider-side outage. Runnin
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · agent-json-tracking.md:157
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- 2026-08-04: Rebuilt the Codex/Claude/Copilot baselines from EVERY session on disk (2137 claude, 2744 codex), not the 5 most recent. Trigger: the day after the 2026-08-03 check, weekly reported `clau
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
INFOInventory / provenanceinv.oversize · _banner-preview/screenshot.png
F-13 Inventory / provenanceCWE-1104Layer L0
_banner-preview/screenshot.png
Why
1498772 bytes not read
Fix
—
INFOInventory / provenanceinv.oversize · assets/agent-sessions-icons.icon/Assets/app-icon-1024.png
F-13 Inventory / provenanceCWE-1104Layer L0
assets/agent-sessions-icons.icon/Assets/app-icon-1024.png
Why
1364243 bytes not read
Fix
—
INFOInventory / provenanceinv.oversize · assets/as-analytics.gif
F-13 Inventory / provenanceCWE-1104Layer L0
assets/as-analytics.gif
Why
4166245 bytes not read
Fix
—
INFOInventory / provenanceinv.oversize · assets/image-browser-dark.png
F-13 Inventory / provenanceCWE-1104Layer L0
assets/image-browser-dark.png
Why
1013041 bytes not read
Fix
—
INFOInventory / provenanceinv.oversize · assets/image-browser-light.png
F-13 Inventory / provenanceCWE-1104Layer L0
assets/image-browser-light.png
Why
1132789 bytes not read
Fix
—
INFOPrompt injectionprompt.authority_framing · perf-fable-review-brief.md:3
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
> **Your role.** You are a senior macOS/Swift performance architect doing an independent design review. Everything below is context so you can spend your effort **thinking**, not gathering. I (the imp
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.credential_read · plans/ios-companion-runway-prd.md:10
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Build the iOS companion around a small Mac-produced status snapshot, not around direct iOS access to Codex credentials, local JSONL logs, or provider APIs.
Why
asks the agent to read credentials
Fix
—
INFOPrompt injectionprompt.credential_read · superpowers/plans/2026-07-08-runway-auth-degradation-plan.md:9
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
**Hard boundary (owner-mandated, spec §1):** Agent Sessions NEVER mints or refreshes its own Claude token. No PKCE, no in-app login, no refresh-token grant *with a token AS read*, no AS-owned Keychain
Why
asks the agent to read credentials
Fix
—
INFOPrompt injectionprompt.credential_read · superpowers/plans/2026-07-19-claude-usage-connection-resilience.md:7
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
**Architecture:** Three surgical changes to `ClaudeUsageSourceManager`'s failure paths (immediate 401 retry with a freshly re-read Keychain token; web-API fallback during rate-limit windows even when
Why
asks the agent to read credentials
Fix
—
INFOPrompt injectionprompt.credential_read · superpowers/plans/2026-07-19-claude-usage-connection-resilience.md:29
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
### Task 1: Immediate 401 retry with a freshly re-read Keychain token
Why
asks the agent to read credentials
Fix
—

Audit 0.4.1 · source sha c5afa9b5ffe9 · 20 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherjazzyalex GitHub userOwner of the repository this skill is read from
  • Source folderjazzyalex/agent-sessions/docsThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdictc5afa9b5ffe9A new audit runs when the source changes
  • Repository statusNot archivedPushed today
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

We did not capture a SKILL.md for this skill, so there is no instruction text to quote here.

Install

Pinned to the audited commit c5afa9b

npm i -g create-dmg  # or brew install create-dmg

Commands as the repository documents them: shown, never run by us. Our verdict covers commit c5afa9b5ffe9 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
Claude DesktopMentioned in its text, not testedSkills for Claude Desktop · About Claude Desktop
CodexMentioned in its text, not testedSkills for Codex · About Codex
GitHub CopilotMentioned in its text, not testedSkills for GitHub Copilot · About GitHub Copilot
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
Gemini CLIMentioned in its text, not testedSkills for Gemini CLI · About Gemini CLI
OpenClawMentioned in its text, not testedSkills for OpenClaw · About OpenClaw
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✕BLOCK D 69 / 100

    first audit · source c5afa9b5ffe9

Similar skills

All automation skills →
ctx-search✓SAFE

mksglu/context-mode

Search context-mode's persistent FTS5 knowledge base for previously indexed local project content, documentation, or session memory. Trigger: /context-mode:ctx-search

★ 33kGrade B
ctx-index✓SAFE

mksglu/context-mode

Index a local file or directory into context-mode's persistent FTS5 knowledge base so future ctx_search calls can retrieve focused snippets without rereading raw files. Trigger: /context-mode:ctx-index

★ 32kGrade B
Context Mode✓SAFE

mksglu/context-mode

Use context-mode tools (ctx_execute, ctx_execute_file) instead of Bash/cat when processing large outputs. Triggers: "analyze logs", "summarize output", "process data", "parse JSON", "filter results", "extract errors",…

★ 26kGrade B
Ctx Doctor✓SAFE

mksglu/context-mode

Run context-mode diagnostics. Checks runtimes, hooks, FTS5, plugin registration, npm and marketplace versions. Trigger: /context-mode:ctx-doctor

★ 26kGrade B
Ctx Insight✓SAFE

mksglu/context-mode

Open the context-mode Insight dashboard in your default browser. Insight is the hosted analytics layer for AI-assisted engineering teams — per-engineer productive rate, retry waste, blocker detection, role-narrowed…

★ 26kGrade B
Ctx Purge✓SAFE

mksglu/context-mode

Purge the context-mode knowledge base. Permanently deletes all indexed content and resets session stats. This is destructive and cannot be undone. Trigger: /context-mode:ctx-purge

★ 26kGrade B

Questions about Docs

What does the Docs skill do?
Local-first macOS app to browse, search, analyze, and resume supported AI coding-agent session history across Codex, Claude Code, OpenCode, Cursor Agent, Antigravity, Hermes, OpenClaw, Copilot CLI, and more.
Is Docs safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can Docs access on my machine?
The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does Docs work with?
Its documentation mentions claude-code, claude-desktop, codex, copilot, cursor, gemini-cli and openclaw. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (c5afa9b5ffe9), read on 2026-10-20. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.