cc-sessions — agentic threat model

Not certain from the listing — relies entirely on Claude Code's underlying foundation models (Anthropic Claude). Threats include prompt injection bypassing Claude's native safety filters, though cc-sessions attempts to mitigate this downstream via hard hooks.

Uses markdown task files with frontmatter and git branches to persist state. Threats include data poisoning of these markdown files or git history, which could inject malicious context or instructions when the session state is restored.

Orchestrates tasks via Python/Node packages and custom hooks. A key threat is hook bypass or logic flaws in the approval-gating mechanism, allowing unauthorized Edit/Write/MultiEdit actions to execute without user consent.

Runs locally within the developer's environment with direct access to git and the local file system. Compromise of the agent could lead to local arbitrary code execution, privilege escalation, or exposure of local git credentials.

Features a dedicated Logging subagent and approval-gated hooks. Threats include logging evasion, tampering with the logging subagent to hide malicious activities, or social engineering attacks that trick the user into typing trigger phrases.

Implements strong local security controls including git branch enforcement and non-bypassable hooks. However, it lacks centralized policy enforcement or formal authorization mechanisms beyond local developer-level approvals.

Coordinates multiple subagents (Context Gathering, Code Review, Logging). Threats include subagent hijacking, where a compromised subagent feeds malicious code reviews or context to the main agent, leading to cascading trust failures.