Security audit

Logbook

Security checks for vulnerabilities and agentic risk

Overview

The skill is advertised as a personal journal, but its documentation and script describe a generic local data tool that keeps a persistent command history.

Review this before installing. Treat it as a local data-processing CLI, not a personal journaling helper, and avoid passing sensitive notes, queries, filenames, or destinations unless you are comfortable with those values being stored in ~/.local/share/logbook/history.log. The publisher should align the name and description with the actual command surface and add clear controls for history logging.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill metadata and title present LogBook as a personal journaling tool, but the documented behavior is a generic local data-processing utility with import, query, transform, validate, export, and cleanup capabilities. This mismatch is dangerous because users or orchestrators may grant it access or invoke it under a lower-risk journaling context while it actually operates on arbitrary local files and stores activity in logs, expanding access and data-handling beyond what was declared.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The manifest advertises a personal diary/log skill, while the body describes a general-purpose dataset toolkit. In an agent ecosystem, this kind of semantic deception can cause unsafe tool routing, overbroad trust, or inappropriate use on sensitive local data because the skill's true operational scope is broader than users expect.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The implementation materially diverges from the stated skill purpose: instead of a journaling-focused tool, it exposes a generic data-processing CLI with commands like query, transform, schema, and dashboard. This kind of scope mismatch is dangerous because it can mislead users and reviewers about what the skill actually does, weakening trust boundaries and increasing the chance that broader data-handling behavior is invoked under the guise of a personal logbook feature.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 67% confidence
Finding: The file states the toolkit performs only local operations, yet it also documents logbook import <file> as accepting any file path. That wording can include non-local paths such as mounted or special filesystem targets, making the 'all operations are local' claim stronger than the documented behavior supports.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill states that every command writes actions to history.log, but the user-facing skill description does not prominently warn about this persistent activity logging. In a personal journaling context, hidden or insufficiently disclosed logging is risky because commands, queries, filenames, and usage patterns may contain sensitive personal information and create an unexpected privacy trail on disk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The inline comments and help text repeatedly describe the tool as a generic data processing and analysis toolkit, directly contradicting the declared journaling purpose. While not an exploit by itself, contradictory self-description is a security-relevant transparency issue because it obscures true capability and can conceal broader-than-expected handling of user data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The helper function appends command arguments to a persistent history file, and multiple commands pass user-supplied parameters into that log without any warning, consent, or sanitization. In a journaling/history context, arguments may contain sensitive personal notes, search terms, file paths, or export targets, so silent retention creates a meaningful privacy and data-exposure risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.