session-resume — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited session-resume (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Purpose: Verify session-skills permissions are configured to prevent repeated permission prompts.
Why this matters:
Implementation:
Run the permission check script:
"${SKILL_BASE:-$HOME/.claude/skills/session-resume}/scripts/check_permissions.sh" "${PROJECT_ROOT:-$PWD}"Script behavior:
When configuration needed:
The script outputs structured information:
session-* wildcards)Present configuration offer to user:
🔧 Session skills need one-time permission setup
[If missing file:]
No .claude/settings.local.json found. I'll create one with required permissions.
[If missing patterns:]
Missing required permissions ([count] patterns):
- Skill(session-closure)
- Skill(session-resume)
- [List other missing REQUIRED patterns]
[If old patterns found:]
Found deprecated patterns ([count] to remove):
- Bash(~/.claude/skills/session-closure/scripts/*)
- [List other FOUND_OLD patterns]
I can configure these automatically using this inline script:
[Show inline bash script that will be executed]
May I update .claude/settings.local.json to add these permissions?After user approval, execute inline configuration script:
#!/bin/bash
# Inline permission configuration script
# Adds/updates .claude/settings.local.json with session-skills permissions
PROJECT_DIR="${PROJECT_ROOT:-$PWD}"
SETTINGS_FILE="$PROJECT_DIR/.claude/settings.local.json"
# Create .claude directory if needed
mkdir -p "$PROJECT_DIR/.claude"
# Required permission patterns
REQUIRED_PATTERNS='[
"Skill(session-closure)",
"Skill(session-resume)",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/check_permissions.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-resume}/scripts/check_permissions.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/check_uncommitted_changes.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/archive_resume.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/validate_resume.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-closure}/scripts/commit_resume.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-resume}/scripts/check_uncommitted_changes.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-resume}/scripts/list_archives.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Bash(\"${SKILL_BASE:-$HOME/.claude/skills/session-resume}/scripts/check_staleness.sh\" \"${PROJECT_ROOT:-$PWD}\")",
"Read(~/.claude/skills/session-closure/**)",
"Read(~/.claude/skills/session-resume/**)"
]'
# Old patterns to remove
OLD_PATTERNS=(
'Bash(~/.claude/skills/session-closure/scripts/*)'
'Bash(~/.claude/skills/session-resume/scripts/*)'
)
if [ ! -f "$SETTINGS_FILE" ]; then
# Create new settings file
cat > "$SETTINGS_FILE" <<EOF
{
"permissions": {
"allow": $REQUIRED_PATTERNS,
"deny": [],
"ask": []
}
}
EOF
echo "✅ Created $SETTINGS_FILE with session-skills permissions"
else
# Merge with existing file using jq
if command -v jq >/dev/null 2>&1; then
# Parse required patterns as JSON array
REQUIRED_JSON=$(echo "$REQUIRED_PATTERNS" | jq -c '.')
# Read existing permissions, add new ones, remove old ones, deduplicate
jq --argjson new "$REQUIRED_JSON" \
'.permissions.allow = ([.permissions.allow[], $new[]] | unique) |
.permissions.allow -= ["Bash(~/.claude/skills/session-closure/scripts/*)", "Bash(~/.claude/skills/session-resume/scripts/*)"]' \
"$SETTINGS_FILE" > "$SETTINGS_FILE.tmp" && mv "$SETTINGS_FILE.tmp" "$SETTINGS_FILE"
echo "✅ Updated $SETTINGS_FILE with session-skills permissions"
else
echo "⚠️ jq not found - manual merge required"
echo "Add these patterns to permissions.allow array:"
echo "$REQUIRED_PATTERNS"
fi
fiAfter configuration:
Error handling:
Purpose: Allow projects to run custom preparation before the uncommitted changes check.
Why this matters:
Implementation:
Check for and run project hook if it exists:
HOOK_PATH="${PROJECT_ROOT:-$PWD}/.claude/hooks/session-pre-check.sh"
if [ -x "$HOOK_PATH" ]; then
"$HOOK_PATH" "${PROJECT_ROOT:-$PWD}"
fiHook location: .claude/hooks/session-pre-check.sh (project-level)
Hook contract:
Common use cases:
.pages, .numbers, temp files)Example hook (stash Apple Pages files):
#!/bin/bash
# .claude/hooks/session-pre-check.sh
# Stash Apple Pages files before session skills run
PROJECT_ROOT="${1:-$PWD}"
cd "$PROJECT_ROOT" || exit 1
# Find modified .pages files
PAGES_FILES=$(git status --porcelain | grep '\.pages$' | awk '{print $2}')
if [ -n "$PAGES_FILES" ]; then
echo "📦 Stashing Apple Pages files (autosave noise)..."
git stash push -m "session-pre-check: .pages files" -- $PAGES_FILES
echo "✓ Stashed. Will auto-pop after session skill completes."
fi
exit 0If hook doesn't exist: Skip silently, proceed to Step 0.5
Error handling:
Purpose: Ensure clean git state before loading resume context.
Why this matters:
Implementation:
Run the uncommitted changes detection script:
"${SKILL_BASE:-$HOME/.claude/skills/session-resume}/scripts/check_uncommitted_changes.sh" "${PROJECT_ROOT:-$PWD}"Script behavior:
When changes detected (BLOCKING):
The script displays:
git status --short outputgit diff HEADRequired action when blocked:
When uncommitted changes are detected, you MUST commit them before proceeding. Follow the Git Commit Protocol (see below).
Process:
git add <files>Why blocking is necessary:
Error handling:
git status.claude/CLAUDE_RESUME.md (preferred, aligns with Claude Code patterns)CLAUDE_RESUME.md (legacy, project root) "${SKILL_BASE:-$HOME/.claude/skills/session-resume}/scripts/list_archives.sh" "${PROJECT_ROOT:-$PWD}" --format detailedScript output:
Present to user:
📋 No current session resume found.
[Script output - archive list or "No previous sessions"]
Would you like to:
1. Start fresh (no resume needed)
2. Load a specific archive (if any exist)Present the resume to the user:
📋 Resuming from [Date] session:
[If Project Status present:]
**Project**: [Project name from resume title]
**Status**: [State emoji + description from Project Status]
**Last activity**: [One-line summary from resume]
[If Sync Status present and has stale dates:]
⚠️ Authoritative sources may need syncing:
- [Source]: Last synced [date] ([N] days ago)
[If Pending Outbound Handoffs present:]
📤 **Pending outbound handoffs**:
- [Destination]: [Summary] (sent [date], [N] days ago)
[If any >7 days: ⚠️ May need follow-up]
**Next focus**: [From "Next Session Focus" section]
**Pending tasks**: [Count] tasks remaining
[List top 3-5 tasks]
[If Key Decisions present: Highlight 1-2 key decisions]
Full context loaded. Ready to continue.After presenting resume, offer:
Would you like to archive this resume to keep project clean?
(Moves to archives/CLAUDE_RESUME/ with timestamp) Ready to continue where you left off!See CORE_PROCESSES.md § Git Commit Protocol for complete requirements.
Quick reference:
git commit -S -s -m "message"Hook enforcement (~/.claude/hooks/):
| Hook | Enforces |
|---|---|
| git-commit-compliance.py | -S -s flags, message quality (≥10 chars), no attribution |
| git-workflow-guidance.py | Separate git add from git commit |
Workflow when Step 0.5 blocks:
git status - See what's changedgit diff - Understand changesgit add <files> - Stage specific changesgit diff --staged - Review staged changesgit commit -S -s -m "..." - Commit with descriptive messageSession-resume skill v0.5.1 - Added pre-check hook, .claude/ location support, version sync (January 2026)
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.