Security audit

session-to-post

Security checks for vulnerabilities and agentic risk

Overview

This skill is a writing assistant for turning coding sessions into posts, with clear privacy review needed before sharing drafts publicly.

Install only if you want an agent to summarize your coding session and repository changes into publishable writing. Before sharing any output, review and redact private codebase details, internal decisions, customer or personal data, unreleased roadmap items, URLs, metrics, and anything copied from the conversation that was not meant to be public.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger list contains broad, common-purpose terms like 'blog', 'marketing', 'storytelling', and 'reddit' that could cause the skill to activate in situations far beyond the author's intended scope. In this skill, unintended invocation is more dangerous because the workflow explicitly gathers git history, file changes, and conversation context for publication-oriented output, increasing the chance of accidental sensitive-data exposure.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill's core purpose is to turn 'real sessions' into public posts, and it frames git history, file changes, and session context as narrative inputs. In this context, the publication workflow itself amplifies the danger: even accurate summarization can expose internal architecture, unreleased features, customer names, incident details, or other sensitive operational information to external audiences.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to write output files and use session-derived material without any explicit privacy warning or user consent checkpoint. Because the output is intended for public-facing posts, omission of a warning materially raises the risk that sensitive repository details, internal context, or user-provided information will be persisted and later published unintentionally.

Ssd 3

Medium

Confidence: 98% confidence
Finding: These instructions explicitly tell the model to mine conversation context, including user goals, constraints, and decisions, as source material for external-facing content. That creates a direct data-leak path from private session dialogue into natural-language summaries, which can reveal confidential business context, roadmap details, credentials-adjacent information, or personal data even if not copied verbatim.

Static analysis

No suspicious patterns detected.