Give isolated sessions (cron jobs, sub-agents, event handlers) full conversation context from your main session using sessions_history. Run cheap background...
Security Analysis
medium confidenceThe skill's requests and instructions are consistent with its stated purpose (give isolated sessions access to main-session history), but it enables handing full conversation context to lower-trust/cheaper sub-agents and relies on other skills/tools for delivery (email/Telegram), so you should review permissions and delivery channels before enabling it.
The name/description say the skill will let isolated sessions read the main session's history; the SKILL.md explicitly uses sessions_list and sessions_history and includes examples doing exactly that. There are no unexpected env vars, binaries, or install steps that conflict with the stated purpose.
The runtime instructions consistently instruct an isolated session to call sessions_history and read memory files, which is exactly the advertised behavior. However, examples also instruct the agent to check email, calendar, and to send messages via Telegram or SMTP. Those actions expand the data flow (conversation history → sub-agent → external delivery) and may expose sensitive conversation contents if the sub-agent or delivery credentials/tools are not trusted. The SKILL.md does not itself supply or require credentials, but it tells the agent to use other skills/tools that do.
Instruction-only skill with no install spec and no downloaded code beyond small example files. This is the lowest-risk install pattern and is coherent with an orchestration-style skill.
The skill declares no required environment variables or secrets, which matches the instruction-only nature. That said, the examples assume use of other skills (email/calendar/Telegram/SMTP) that generally require credentials; the skill's instructions will cause those credentials to be used if present. This is not an immediate mismatch but is a privacy/credential flow you should evaluate before enabling.
always is false and the skill is user-invocable with normal autonomous invocation allowed. The skill does not request permanent system presence or modify other skills' configs. Its behavior (invoking sessions_history from isolated sessions) relies on existing platform tools rather than escalating privileges.
Guidance
This skill does what it says: it instructs isolated (cheaper) sessions to fetch the main session's conversation history so they can act with context. That is powerful but also a privacy surface: any sub-agent that receives that history can forward it to external channels (Telegram, email, webhooks) or store it in memory files. Before installing or enabling this skill, decide whether you trust the code and any sub-agents that will receive context, and audit the delivery tools it will call. Recommendations: - Restrict which session keys can be queried by isolated sessions (don't expose broad 'agent:main:*' keys if possible). - Limit the sessions_history limit (e.g., 10–50 messages) and sanitize or redact sensitive tokens/PII before passing history along. - Review and restrict downstream delivery channels (Telegram bots, SMTP, webhooks) and ensure their credentials are protected. - Test with non-sensitive data first to confirm no unintended data flows. If you can provide the platform's sessions_history access controls (who can call it and whether calls are audited), or any runtime policy that limits what isolated sessions can do with fetched history, I can raise confidence and narrow further advice.
Latest Release
v1.0.2
Fix docs: Remove unverified email delivery claims. Telegram tested and works. Email requires additional SMTP config or use heartbeats.
Popular Skills
Published by @RGBA-Research on ClawHub
