Security audit

Recall

Security checks for vulnerabilities and agentic risk

Overview

This recall skill is mostly purpose-aligned, but it can search broad private workspace history and notes with loose triggering and optional persistent tooling.

Install only if you are comfortable with the agent searching past memory, chat logs, session state, and workspace notes. Use it for explicit recall requests, review generated HTML before opening when sensitive data may appear, and avoid the optional global npm install unless you have independently trusted and pinned the package.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:30
Finding: Overly Broad Access to Persistent Memory, Chat Logs, and Workspace Notes
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:131
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list ends with a broad catch-all for 'any temporal/historical query about past work,' which can cause the skill to activate when the user did not explicitly consent to searching session history. Because this skill reads prior session memory and notes, overly permissive invocation increases the chance of unintended disclosure of sensitive historical context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Topic mode states it searches 'Any notes in the workspace' but does not clearly warn the user that the search scope extends beyond the dedicated memory directory. This can expose unrelated or sensitive workspace content during recall operations, especially if users assume only memory/ and session-state files are queried.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Graph mode writes an HTML file and instructs the agent to open it in a browser without prominently warning the user. Creating and opening a generated HTML artifact can leak project structure, surprise the user with side effects, and introduce risk if the visualization includes unsafe content or is opened automatically in a privileged local context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.