Security audit
Security checks for vulnerabilities and agentic risk
This is a local checksum utility whose main risk is that it keeps local history and batch manifest files by default.
Install this only if you are comfortable with a local checksum tool keeping records under ~/.local/share/hash. Avoid running batch mode on sensitive directories unless you want a saved manifest of file paths and hashes, and delete the history or manifest files afterward if they reveal private project structure.
The logging function persistently records operation details including file paths and hashes, and text-hash operations also create an audit trail of sensitive activity. In a security tool context, file names, integrity targets, and even the existence of hashed secrets or internal artifacts can be sensitive and useful for local adversaries or forensic over-collection.
Persistent history is written without explicit user warning or consent, despite containing file paths and hash activity that may be operationally sensitive. The lack of transparency makes this more dangerous because users of a simple checksum tool would reasonably expect ephemeral processing, not local telemetry-like retention.
Batch mode silently creates a manifest file containing hashes and file paths without warning, which can leave behind sensitive artifacts after use. In the context of a checksum utility, this hidden persistence is more concerning because users may process proprietary or confidential file trees and not realize an indexed record was saved locally.
The script creates a persistent data directory and stores history/manifests under the user's home directory, which goes beyond a pure hashing utility's stated purpose. While not directly exploitable as code execution, it introduces unnecessary data retention of user activity and file metadata that can expose sensitive paths and operational history.
The manifest says the skill is for generating MD5/SHA checksums, verifying integrity, and comparing hash values. The code expands scope with recursive directory hashing, checksum-file verification, and viewing prior operation history, which are meaningful capabilities beyond the concise manifest summary.
Batch mode writes a manifest of all hashed files to persistent storage in the user's home directory, creating an inventory of files and hashes that may reveal sensitive filenames, directory structures, and integrity data. This exceeds the minimal need to print results and can expose information to other local processes or users if permissions are weak.
No suspicious patterns detected.
