Security audit

Lite Session Cleaner

Security checks for vulnerabilities and agentic risk

Overview

This session-cleanup skill does the advertised cleanup work, but it also reads and stores conversation-derived summaries locally without clear disclosure or retention controls.

Review before installing. Use it only if you accept an automated job that can kill inactive sessions and if you are comfortable with it reading session content and saving summaries locally. For production use, remove or explicitly disclose the summary feature, make the timeout and storage path configurable, add dry-run or exclusion safeguards, and define retention/deletion controls for any stored summaries.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill's declared purpose is to clean up inactive sessions and send notifications, but it additionally retrieves conversation history, generates summaries, and persists them to disk. This expands the data-access and retention scope beyond what is necessary, creating an unjustified privacy and data-handling risk if real session content contains sensitive information.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: Accessing full session message history is not necessary to determine inactivity, notify users, or terminate stale sessions. In a cleanup skill, this constitutes overprivileged access to potentially sensitive conversation data and increases exposure if the skill is compromised, misused, or later extended.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: Writing session summaries to local disk creates a new data-retention surface for content derived from user conversations, which is unnecessary for basic session cleanup. Stored summaries may persist beyond session lifetime, be accessible to other local processes or users, and undermine expectations that cleanup reduces retained data.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The skill is designed to automatically terminate sessions after an inactivity threshold, but the description does not prominently warn users or operators about the disruptive nature of that action. In context, this can lead to unexpected session loss, interruption of active-but-idle work, or accidental termination of important workflows if deployed unattended.

Natural-Language Policy Violations

Low

Confidence: 72% confidence
Finding: The skill hardcodes a Chinese-language termination message without documenting locale assumptions, configurability, or user consent. While not a direct security flaw, this can mislead recipients, reduce comprehension of an important session-termination notice, and increase operational risk by preventing affected users from understanding what happened and responding appropriately.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code stores derived conversation data locally without any user-facing disclosure or warning, so users would not reasonably understand that cleanup triggers additional retention. Lack of transparency around local storage makes privacy harm more likely and prevents informed consent for handling potentially sensitive content.

Static analysis

No suspicious patterns detected.