Security audit

doc-search

Security checks for vulnerabilities and agentic risk

Overview

This document-search skill is mostly legitimate, but its local persistence design can retain private documents and automatically loads unsafe pickle files.

Review before installing. Use only in trusted project directories, avoid indexing sensitive documents unless local retention is acceptable, and clear or delete the local chroma_data store when finished. Do not use it where untrusted users or processes can modify the persistence files; a safer version should replace pickle with a non-code-executing storage format and add confirmation for destructive clearing.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill states that vector data and indexes are automatically saved to disk and reloaded across restarts, but it does not clearly warn that document contents and metadata will be retained locally. Because source documents may contain sensitive data, silent persistence increases the risk of unintended retention, later disclosure, and privacy noncompliance.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documented clear_collection() operation can erase the entire vector store, yet the skill does not warn that this action is destructive and potentially irreversible. In a retrieval system with automatically persisted data, accidental or unauthorized invocation could cause permanent loss of indexed documents, metadata, and search history context.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code deserializes persisted state with pickle.load() from a file path under a configurable persistence directory. Pickle is not safe for untrusted input and can trigger arbitrary code execution during loading if an attacker can modify the .pkl file or influence that directory, which is especially relevant for an agent skill that automatically loads data at startup.

Static analysis

No suspicious patterns detected.