Security audit

Future Journal Publish

Security checks for vulnerabilities and agentic risk

Overview

This is an offline journal skill with clearly disclosed optional encrypted sync, and I found no hidden or deceptive behavior.

Installers should understand that normal use is local-only, but enabling sync will send email/auth traffic to the backend they configure and encrypted journal ciphertext to that backend. Keep backups, protect the browser profile, and do not enable sync with someone else's configuration string.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (12)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
md
| `assets/index.html` | 完整的手账页面。单文件、双击即可打开；不配同步时全程离线、不发任何请求 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
| `assets/index.html` | 完整的手账页面。单文件、双击即可打开；不配同步时全程离线、不发任何请求 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.
md
| `assets/index.html` | 完整的手账页面。单文件、双击即可打开；不配同步时全程离线、不发任何请求 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.
md
| `assets/index.html` | 完整的手账页面。单文件、双击即可打开；不配同步时全程离线、不发任何请求 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.
md
| `assets/index.html` | 完整的手账页面。单文件、双击即可打开；不配同步时全程离线、不发任何请求 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.
md
| `assets/index.html` | 完整的手账页面。单文件、双击即可打开；不配同步时全程离线、不发任何请求 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.
md
| `assets/index.html` | 完整的手账页面。单文件、双击即可打开；不配同步时全程离线、不发任何请求 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
以上 5 个文件（含 `SKILL.md` 自身）是 skill 的完整能力面，**发放给别人的就是这些**。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.
md
以上 5 个文件（含 `SKILL.md` 自身）是 skill 的完整能力面，**发放给别人的就是这些**。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.
md
以上 5 个文件（含 `SKILL.md` 自身）是 skill 的完整能力面，**发放给别人的就是这些**。

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document states that the default locale is Simplified Chinese (zh-CN) and other locales are only available on request. This is a natural-language locale policy constraint that does not offer an explicit user choice or opt-in for interface language selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This section again specifies that the default UI locale is zh-CN, while other locales are merely available on request. Requiring a specific locale by default without an explicit user-facing choice can violate organizational language/locale policy.
Content: No source excerpt is available for this finding.