Security audit
Security checks for vulnerabilities and agentic risk
This skill is advertised as a thesaurus, but the included script is mostly a generic local activity/history tracker rather than a synonym or antonym lookup tool.
Review before installing. This package is not a real thesaurus as shipped; it is better understood as a local command-history tracker with unclear and partly broken export/status behavior. Avoid using it for sensitive text or private prompts unless you specifically want local activity logs under ~/.local/share/thesaurus and have reviewed the script yourself.
The skill presents itself as a thesaurus tool but the documented behavior is a generic input/activity logger with unrelated commands and shell-like interpolations. This mismatch is dangerous because users or an orchestrating agent may trust it for harmless lexical lookup while it actually collects, stores, and exports arbitrary input, increasing the risk of unintended data capture and misuse.
The manifest and help text describe synonym/antonym lookup, but the available commands and outputs indicate a broad action-tracking utility instead. In an agent ecosystem, this kind of semantic deception can trigger the skill in inappropriate contexts and cause sensitive prompts or task data to be logged under the guise of a low-risk dictionary feature.
The script is presented as a thesaurus tool, but the exposed commands implement a generic local activity logger rather than synonym/antonym lookup. This capability mismatch is dangerous because users may trust the skill with language-related inputs while it silently stores arbitrary content to disk, expanding data collection beyond the stated purpose and undermining informed consent.
The activation description is broad enough to match many ordinary writing, analysis, and word-choice tasks beyond a narrow thesaurus use case. Because the skill also appears to log user inputs, broad triggering increases the chance that unrelated or sensitive content is routed into this skill unnecessarily.
The skill exposes broad generic workflow commands such as run, check, convert, analyze, generate, batch, compare, config, and report that are unrelated to a thesaurus tool's stated purpose. In this context, unnecessary capability breadth increases the attack surface and makes it easier to hide covert data collection or repurpose the skill for unintended tracking of user activity.
The export function aggregates contents from all .log files into export artifacts, potentially concentrating a broad set of previously collected user inputs into a single easily shared file. In the context of a misrepresented thesaurus skill that already logs inputs without warning, this materially increases disclosure risk by making sensitive history simpler to exfiltrate, copy, or mishandle.
Each command appends all user-supplied input to persistent log files under ~/.local/share/thesaurus, and the help/comments do not clearly warn users that their inputs will be stored. This is dangerous because users may enter sensitive words, phrases, or copied text expecting a lookup tool, but the script silently creates a durable local history that could later be read by other processes or exposed through backups and shared accounts.
The command dispatcher defines an export) branch that logs user input, while a later export) branch intended to perform real export is unreachable because the first matching case wins. This is dangerous because the skill advertises data export behavior but instead captures and persists whatever the user supplies to export, creating deceptive behavior and unexpected retention of potentially sensitive data.
The command dispatcher similarly shadows the real status handler with an earlier status) branch that logs arbitrary input instead of showing health information. This is dangerous because users invoking a harmless status check may unknowingly create persistent records, and the misleading interface conceals the tool's actual data collection behavior.
The statement at L017 presents a strong offline/no-data-leaves-machine guarantee as part of the tool's intent. Later documentation includes external contact/feedback endpoints, which contradicts the absolute offline framing even if the core commands may be local, because the documentation itself introduces network-oriented interaction as part of the skill experience.
No suspicious patterns detected.
