skills.rest
rad-security
rad-securityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

recap

Summarize Claude Code session logs to count tool calls, list modified files, capture commands, and surface threats.

2|1|Updated Apr 3, 2026
Search Tags:#security#session#log-analysis#recap#tool-calls#threats#local-logs
One-click install
npx skills add https://github.com/rad-security/claude-code-plugin --skill recap-rad-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: recap
Source: https://github.com/rad-security/claude-code-plugin/tree/main/plugins/clawkeeper-code/skills/recap
Command: npx skills add https://github.com/rad-security/claude-code-plugin --skill recap-rad-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a security-focused recap of Claude Code sessions by reading local logs to surface tool usage, file changes, commands run, and detected threats.

Core Features & Use Cases

  • Read and summarize session data from local logs to show tool call counts, files modified, and commands executed.
  • Detect and present potential threats observed during a session for quick review and audit.
  • Use Case: After a sensitive session, generate a concise recap for security teams and for incident documentation.

Quick Start

Run a recap after a session to view tool usage, file changes, commands run, and any threats detected.

Frequently Asked Questions about recap

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I get a security recap of my Claude Code session?▼

To get a security recap of your Claude Code session, use the recap tool to read local session logs and summarize tool calls, modified files, executed commands, and detected threats.

What is the best way to audit local session logs for threats?▼

The best way to audit local session logs for threats is to parse the JSONL entries in your current session log file to surface and review security-relevant activity.

Does the recap tool require access to specific local log files?▼

Yes, the recap tool requires read access to the local session log located at CK_DIR or $HOME/.clawkeeper-plugin/sessions/current.jsonl to parse session data.

Can I track which files were modified and commands were executed during a session?▼

Yes, you can track modified files and executed commands by reading local session data, which parses each JSONL entry to count tool calls and list file changes.

How do I document security threats found in local session data?▼

To document security threats found in local session data, generate a concise recap that detects and presents potential threats observed during the session for quick review.

Related Skills

Explore More Data & Analytics Skills→
gmautnergmautner
3

Pre-Flight Check

Validate working directory and detect untracked content before project initialization.

Community
Intermediate
harperaaharperaa
15

security-prompts-threat-modeling

Generate STRIDE threat-model prompts for architecture, code reviews, and compliance assessments.

Community
Intermediate
pauljbernardpauljbernard
5

Threat Intelligence Director Excellence

Coordinate cyber threat analysis, intelligence collection, and incident response.

Community
Advanced
191854169191854169

session-logs

Search and summarize historical session logs stored as JSONL files.

Community
Intermediate