session-closure — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited session-closure (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Purpose: Verify session-skills permissions are configured to prevent repeated permission prompts.
Why this matters:
Implementation:
Run the permission check script:
"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/check_permissions.sh" "${PROJECT_ROOT:-$PWD}"Script behavior:
When configuration needed:
The script outputs structured information:
session-* wildcards)Present configuration offer to user:
🔧 Session skills need one-time permission setup
[If missing file:]
No .claude/settings.local.json found. I'll create one with required permissions.
[If missing patterns:]
Missing required permissions ([count] patterns):
- Skill(session-closure)
- Skill(session-resume)
- [List other missing REQUIRED patterns]
[If old patterns found:]
Found deprecated patterns ([count] to remove):
- Bash(~/.claude/skills/session-closure/scripts/*)
- [List other FOUND_OLD patterns]
I can configure these automatically using this inline script:
[Show inline bash script that will be executed]
May I update .claude/settings.local.json to add these permissions?After user approval, execute inline configuration script:
#!/bin/bash
# Inline permission configuration script
# Adds/updates .claude/settings.local.json with session-skills permissions
PROJECT_DIR="${PROJECT_ROOT:-$PWD}"
SETTINGS_FILE="$PROJECT_DIR/.claude/settings.local.json"
# Create .claude directory if needed
mkdir -p "$PROJECT_DIR/.claude"
# Required permission patterns
REQUIRED_PATTERNS='[
"Skill(session-closure)",
"Skill(session-resume)",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/check_permissions.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-resume}/scripts/check_permissions.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/check_uncommitted_changes.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/archive_resume.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/validate_resume.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/commit_resume.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-resume}/scripts/check_uncommitted_changes.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-resume}/scripts/list_archives.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-resume}/scripts/check_staleness.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Read(~/.claude/skills/session-closure/**)",
"Read(~/.claude/skills/session-resume/**)"
]'
# Old patterns to remove
OLD_PATTERNS=(
'Bash(~/.claude/skills/session-closure/scripts/*)'
'Bash(~/.claude/skills/session-resume/scripts/*)'
)
if [ ! -f "$SETTINGS_FILE" ]; then
# Create new settings file
cat > "$SETTINGS_FILE" <<EOF
{
"permissions": {
"allow": $REQUIRED_PATTERNS,
"deny": [],
"ask": []
}
}
EOF
echo "✅ Created $SETTINGS_FILE with session-skills permissions"
else
# Merge with existing file using jq
if command -v jq >/dev/null 2>&1; then
# Parse required patterns as JSON array
REQUIRED_JSON=$(echo "$REQUIRED_PATTERNS" | jq -c '.')
# Read existing permissions, add new ones, remove old ones, deduplicate
jq --argjson new "$REQUIRED_JSON" \
'.permissions.allow = ([.permissions.allow[], $new[]] | unique) |
.permissions.allow -= ["Bash(~/.claude/skills/session-closure/scripts/*)", "Bash(~/.claude/skills/session-resume/scripts/*)"]' \
"$SETTINGS_FILE" > "$SETTINGS_FILE.tmp" && mv "$SETTINGS_FILE.tmp" "$SETTINGS_FILE"
echo "✅ Updated $SETTINGS_FILE with session-skills permissions"
else
echo "⚠️ jq not found - manual merge required"
echo "Add these patterns to permissions.allow array:"
echo "$REQUIRED_PATTERNS"
fi
fiAfter configuration:
Error handling:
Purpose: Allow projects to run custom preparation before the uncommitted changes check.
Why this matters:
Implementation:
Check for and run project hook if it exists:
HOOK_PATH="${PROJECT_ROOT:-$PWD}/.claude/hooks/session-pre-check.sh"
if [ -x "$HOOK_PATH" ]; then
"$HOOK_PATH" "${PROJECT_ROOT:-$PWD}"
fiHook location: .claude/hooks/session-pre-check.sh (project-level)
Hook contract:
Common use cases:
.pages, .numbers, temp files)Example hook (stash Apple Pages files):
#!/bin/bash
# .claude/hooks/session-pre-check.sh
# Stash Apple Pages files before session skills run
PROJECT_ROOT="${1:-$PWD}"
cd "$PROJECT_ROOT" || exit 1
# Find modified .pages files
PAGES_FILES=$(git status --porcelain | grep '\.pages$' | awk '{print $2}')
if [ -n "$PAGES_FILES" ]; then
echo "📦 Stashing Apple Pages files (autosave noise)..."
git stash push -m "session-pre-check: .pages files" -- $PAGES_FILES
echo "✓ Stashed. Will auto-pop after session skill completes."
fi
exit 0If hook doesn't exist: Skip silently, proceed to Step 0.5
Error handling:
Before archiving or creating new resume, check for ANY uncommitted changes in the repository.
Why: User may have manually edited files between sessions. These changes contain important context that should be reviewed and preserved in git history.
Implementation:
Run the uncommitted changes detection script:
"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/check_uncommitted_changes.sh" "${PROJECT_ROOT:-$PWD}"Script behavior:
When changes detected (BLOCKING):
The script displays:
git status --short outputgit diff HEADRequired action when blocked:
When uncommitted changes are detected, you MUST commit them before proceeding:
git add <files>
git commit -S -s -m "Pre-closure changes: $(date +%Y-%m-%d-%H%M)
CLAUDE_RESUME.md: [what changed]
LOCAL_CONTEXT.md: [what changed]
[other files]: [what changed]"Why blocking is necessary:
Error handling:
git statusRun archive script before creating new resume:
"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/archive_resume.sh" "${PROJECT_ROOT:-$PWD}"Script behavior:
archives/CLAUDE_RESUME/<timestamp>.mdOutput messages:
Analyze the session: What completed? What decisions made and why? Tasks pending? Blockers? Insights? Critical context?
If context is limited, focus on essential state. Optional sections (Key Decisions, Insights & Learnings) can be skipped.
Location (two supported locations):
.claude/CLAUDE_RESUME.md (preferred, aligns with Claude Code patterns)CLAUDE_RESUME.md (legacy, project root)Use same location as existing resume if one exists. For new resumes, prefer .claude/ if that directory exists.
Format: See references/RESUME_FORMAT_v1.3.md for complete specification.
BEFORE creating file, verify you will include ALL required sections:
Required sections (verify before writing):
**Last Session**: [date], duration, overall status## Last Activity Completed## Pending Tasks## Session Summary## Project Status (required)## Next Session Focus*Resume created by session-closure v[version]: [timestamp]*Optional sections (include if applicable and context allows):
## Key Decisions Made## Insights & Learnings## Sync Status (only if external authoritative sources exist)## Pending Outbound Handoffs (only if handoffs sent awaiting response)After verifying checklist, create file with these sections:
Validate resume after creation:
"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/validate_resume.sh" "${PROJECT_ROOT:-$PWD}"Checks: File exists, required sections present, footer format correct.
Output:
If validation fails: Add missing sections, re-run validation.
See CORE_PROCESSES.md § Git Commit Protocol for commit requirements.
Quick reference: git commit -S -s -m "message" (no Claude attribution)
Run commit script:
"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/commit_resume.sh" "${PROJECT_ROOT:-$PWD}"Script behavior:
Output:
✅ Session resume committed - Success✓ No uncommitted changes - Already clean✓ Not a git repository - Skipped❌ ERROR: Unexpected changes detected - Unexpected files modifiedHook enforcement: User-level hooks (~/.claude/hooks/) validate all commits:
git-commit-compliance.py: -S -s flags, message quality, no attributiongit-workflow-guidance.py: Separate git add from git commitReport completion after validation:
✅ Session closure complete.
📄 CLAUDE_RESUME.md created and validated
[Archive output if applicable]
Summary: [One sentence about session outcome]
💡 Next session: Say "resume" to continue from here.Session-closure skill v0.5.1 - Added pre-check hook, .claude/ location support, version sync (January 2026)
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.