Security audit
Security checks for vulnerabilities and agentic risk
Fish appears to be a local command logger with vague utility framing and misleading command behavior, so users should review its data retention before installing.
Install only if you intentionally want a local history/logging tool and are comfortable with command inputs being stored under ~/.local/share/fish. Avoid entering secrets, tokens, private notes, or sensitive filenames, and manually inspect or delete that directory if you need to clear retained data.
The skill is presented as a vague utility tool, but the documentation also describes persistent storage of command inputs, activity logging, searching historical entries, and exporting accumulated data. That mismatch is dangerous because users may invoke it without understanding that their inputs and usage history are being retained locally, which can capture sensitive prompts, filenames, or operational data.
The description 'Use when you need fish' is so broad that it provides no meaningful trigger boundaries for when the skill should activate. In an agent environment, ambiguous invocation scope can cause inappropriate selection of this skill, increasing the chance that user inputs get logged or processed by a tool they did not intend to use.
Generic command labels like 'Run', 'Check', 'Convert', and 'Analyze' do not define what data they operate on, what actions they take, or what side effects occur. This ambiguity makes the skill harder to reason about safely and may lead to overbroad use in contexts involving sensitive local data, especially given the documented history logging.
The script is presented as a generic utility tool, but its actual behavior is to persistently collect and store user-provided inputs across many commands under ~/.local/share/fish. This mismatch can mislead users into disclosing sensitive data they would not expect to be retained, increasing privacy and data-handling risk.
The tool is designed to retain all natural-language inputs and then expose them via bulk export, search, and recent-history views, creating a broad local data-retention surface. In a skill context where users may enter arbitrary task content, this materially increases the chance of sensitive information being accumulated and later exposed to other local users, backups, or accidental sharing.
The help text advertises export and status functionality, but the earlier case branches for export and status only log user input instead of calling the real _export or _status functions. This deceptive command behavior can cause users to enter sensitive operational data under the assumption that a harmless status/export operation is occurring, when the data is actually being stored.
The command handlers write raw user-supplied input to persistent log files without any explicit notice, consent, or data classification safeguards. Users may provide secrets, tokens, internal notes, or personal data that then remain on disk and become accessible through search, recent, and export features.
The SKILL.md states 'Works entirely offline — your data never leaves your machine' at L017, but the same document prominently directs users to a web feedback endpoint and external homepage/source URLs elsewhere. This is a documentation-level contradiction about the skill's offline framing, even though the file shown does not include executable code making network requests.
No suspicious patterns detected.
