From 223f250c2a5070b5268620eb5deb85b467cbe550 Mon Sep 17 00:00:00 2001
From: Rayan-and-beyond <263488867+Rayan-and-beyond@users.noreply.github.com>
Date: Tue, 15 Sep 2026 19:38:57 +0000
Subject: [PATCH] feat: flag shell history access

---
 CHANGELOG.md                       |  1 +
 package.json                       |  2 +-
 src/rules.js                       |  5 +++++
 test/sec-007-shell-history.test.js | 26 ++++++++++++++++++++++++++
 4 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 test/sec-007-shell-history.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 70144b9..cad7901 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ All notable changes to this project are documented here, following
 
 ### Added
 
+- **SKILL-SEC-007**: flag references to bash, zsh, and PowerShell ConsoleHost history files.
 - **SKILL-SUP-003**: flag code that fetches scripts or packages over plaintext `http://`.
 - Rule `SKILL-SH-010` (critical, code): flags SSH key planting via
   `authorized_keys` or shell redirects into `~/.ssh/`.
diff --git a/package.json b/package.json
index 117b5ea..3b2a83c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@royalpinto007/skill-audit",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Security scanner for agent skills. Scan a Claude/agent Skill for prompt-injection, dangerous shell, secret access, and exfiltration before you trust it. Zero dependencies, SARIF output, npx skill-audit <path>.",
   "type": "module",
   "bin": {
diff --git a/src/rules.js b/src/rules.js
index 88b54ed..f4e4bc9 100644
--- a/src/rules.js
+++ b/src/rules.js
@@ -110,6 +110,11 @@ export const RULES = [
     remediation: "Reading the keychain, keyring, or secret-tool exposes stored credentials.",
     pattern: /(security\s+find-generic-password|gnome-keyring|\bsecret-tool\b|keychain)/gi },
 
+  { id: "SKILL-SEC-007", severity: "high", category: "secret-access", appliesTo: "code",
+    title: "Reads shell-history files",
+    remediation: "Shell history can contain commands with credentials and other secrets. Do not read it from a skill.",
+    pattern: /(\.bash_history\b|\.zsh_history\b|ConsoleHost_history(?:\.txt)?\b)/gi },
+
   // ---- Network exfiltration ----
   { id: "SKILL-NET-001", severity: "high", category: "exfiltration", appliesTo: "code",
     title: "Uploads a local file over the network",
diff --git a/test/sec-007-shell-history.test.js b/test/sec-007-shell-history.test.js
new file mode 100644
index 0000000..e9fce5f
--- /dev/null
+++ b/test/sec-007-shell-history.test.js
@@ -0,0 +1,26 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { scanText } from "../src/scan.js";
+
+test("SKILL-SEC-007 flags shell-history file references", () => {
+  for (const [source, file] of [
+    ["cat ~/.bash_history\n", "setup.sh"],
+    ["tail -n 50 ~/.zsh_history\n", "setup.sh"],
+    ["Get-Content $env:APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt\n", "setup.ps1"],
+  ]) {
+    const findings = scanText(source, file, null).filter((f) => f.rule === "SKILL-SEC-007");
+    assert.equal(findings.length, 1, `${file}: ${source}`);
+    assert.equal(findings[0].severity, "high");
+  }
+});
+
+test("SKILL-SEC-007 ignores ordinary history-related text", () => {
+  for (const source of [
+    "history | tail -20\n",
+    "echo 'keep a changelog of command history'\n",
+    "const history = []\n",
+  ]) {
+    const findings = scanText(source, "setup.sh", null).filter((f) => f.rule === "SKILL-SEC-007");
+    assert.equal(findings.length, 0, source);
+  }
+});