Security audit
Security checks for vulnerabilities and agentic risk
The skill is a code-review helper, but it can automatically export full local coding-session history, including tool inputs and outputs, to another review process without clear minimization or consent controls.
Review before installing. Use this only if you are comfortable with vet receiving your git diff and potentially full coding-session history, including prompts, code snippets, file paths, command output, and tool results. Prefer running without conversation history for sensitive repositories, pin and verify the verify-everything package, and avoid letting the skill search or export session files without explicit approval.
scripts/export_codex_session.py:32Unrestricted Export of Sensitive Conversation and Tool History
SKILL.md:14Unpinned Installation and Execution of a Security-Sensitive Third-Party Package
The OpenCode flow directs the agent to enumerate sessions and search for the current conversation, then pass that data into export scripts. That is more invasive than the advertised purpose and could lead to collection of unrelated session content if matching is wrong or ambiguous, creating confidentiality and privacy risks.
The OpenCode flow directs the agent to enumerate sessions and search for the current conversation, then pass that data into export scripts. That is more invasive than the advertised purpose and could lead to collection of unrelated session content if matching is wrong or ambiguous, creating confidentiality and privacy risks.
The OpenCode flow directs the agent to enumerate sessions and search for the current conversation, then pass that data into export scripts. That is more invasive than the advertised purpose and could lead to collection of unrelated session content if matching is wrong or ambiguous, creating confidentiality and privacy risks.
The manifest describes a skill whose purpose is to run vet immediately after logical code changes, but this file implements a standalone exporter that parses Claude Code session history and emits transformed conversation/tool-use records. Exporting chat sessions is a materially different capability from triggering or performing vet, so the code's actual behavior diverges from the declared skill behavior.
The script exports full Codex session history, including user messages, assistant messages, tool invocations, and tool outputs, which is materially different from the skill's stated purpose of proactively running vet after code changes. This mismatch increases the risk of covert data collection and exfiltration of sensitive prompts, code, secrets, or tool output under the guise of a benign developer workflow skill.
The skill instructs the agent to use shell commands and read local files/session data, but it declares no explicit tool scope or permissions boundary. In a skill system, missing scope makes it easier for the skill to be invoked with broader-than-expected capabilities and obscures review of what sensitive resources it needs to access.
The instruction to run vet immediately after any logical unit of code changes and to be proactive is extremely broad, which can trigger repeated, automatic invocation without clear user intent. In context, because vet may read diffs and conversation history via shell and local files, overbroad activation increases the chance of unnecessary data exposure, noisy autonomous actions, and accidental use in sensitive contexts.
The script emits raw user messages, assistant messages, tool inputs, and tool results directly to stdout, which can include secrets, source code, file paths, or command output from the session file. In the context of a 'vet' skill, exporting full session history increases exposure because the data may be piped into logs, other tools, or remote analysis without any minimization or explicit acknowledgment.
The code reconstructs and emits structured session transcripts from a JSONL session file, including tool calls and outputs, despite the metadata claiming the skill exists only to run vet after logical code changes. In this skill context, unrelated transcript-export capability is suspicious because it can expose sensitive development context without a clear operational need.
The script writes exported session history to a temporary file on disk before parsing it, which can expose sensitive chat content and tool output to local disclosure risks such as other privileged processes, backups, forensic recovery, or incomplete cleanup after abnormal termination. Because the file contains full session export data, the confidentiality impact can be broader than the narrow purpose of the skill suggests.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
try:
with os.fdopen(fd, "w+b") as f:
try:
result = subprocess.run(
["opencode", "export", args.session_id],
stdout=f,
stderr=subprocess.PIPE,
The script exports full OpenCode session history even though the skill's stated purpose is only to run vet after code changes. That creates an unnecessary capability to access and transform potentially sensitive conversation and tool-use data, expanding the skill's access beyond its declared need and increasing the risk of privacy leakage or misuse.
The script sends a session identifier to an external CLI to export conversation history without any evident user-facing disclosure that session data is being accessed and emitted. In the context of a skill advertised as merely running vet, this hidden data access is more concerning because users would not reasonably expect broad session-history processing.
No suspicious patterns detected.