ClawHub
Back to skill

Security audit

aeon

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent for managing Aeon, but it deserves Review because its history-mining mode reads broad local coding-agent transcript history that may contain sensitive past prompts.

Install only if you want an assistant to manage Aeon repo setup, schedules, skills, and related secrets. Before using history mining, explicitly choose a small time window and preferably a --project scope, and do not allow raw transcript content into notifications or commits. Keep Langfuse tracing off for sensitive work, or set LANGFUSE_LOG_CONTENT=0, and use least-privilege GitHub tokens where possible.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The observability section states that enabling Langfuse causes every run to stream traces including LLM calls, tokens, cost, and prompts to an external service, but it does not prominently warn about the privacy and data-handling implications. In an agent system that may process secrets, repo content, or sensitive prompts, users could enable tracing without understanding that potentially sensitive run data leaves the local/repo boundary.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This script recursively scans and parses local coding-agent transcript history from ~/.claude/projects and ~/.codex/sessions, which can contain sensitive prompts, file paths, secrets, and operational context. It does so automatically when run, with no explicit consent prompt, dry-run warning, or requirement to opt in at runtime, increasing the risk of unintended privacy exposure during local use.

Ssd 3

Medium
Confidence
89% confidence
Finding
The skill instructs the agent to scan local coding-agent transcript directories, which can contain sensitive prompts, secrets, proprietary code snippets, credentials, and personal data from prior sessions. Even though the text says the aggregate digest is surfaced and not raw content, the capability materially expands access to historical sensitive data and creates risk of over-collection or accidental disclosure.

Agent Config Directory Access

High
Category
Agent Snooping
Content
## Mode 8 — Mine history for skills to automate

"What am I doing by hand over and over that Aeon could just do?" Mode 4 turns *this* chat into a skill; Mode 8 mines *past* chats to find which chat is worth turning into one. It reads the operator's local coding-agent transcripts (`~/.claude/projects` or `~/.codex/sessions`), so it only works on their own machine — never inside an Aeon run.

1. **Scan.** Run the miner from the instance repo root:
Confidence
95% confidence
Finding
This section explicitly directs access to local agent transcript directories such as '~/.claude/projects' or '~/.codex/sessions'. Those locations are effectively agent config/history stores and may contain highly sensitive historical interactions; giving a skill instructions to enumerate and parse them increases the chance of privacy breach, credential exposure, and cross-project data leakage.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.