Security audit

session-tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local crash-recovery helper that persistently records task progress and optional filesystem metadata, with its main behaviors disclosed and aligned with its purpose.

Install this only if you want local crash recovery for multi-step work and are comfortable with .session retaining task names, step descriptions, declared file paths, and worklog entries until cleanup or pruning. Avoid scan/status/monitor on sensitive projects unless metadata about download, upload, .session, and skills directories is acceptable, and use --auto-cleanup or cleanup when recovery state is no longer needed.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The `status()` command unconditionally calls `take_snapshot()` and compares filesystem metadata even though the skill description says filesystem scanning is off by default unless explicitly enabled. This creates an undisclosed collection path for file names and metadata from monitored directories, undermining the user's privacy expectations and the tool's stated security boundary.

Scope Creep

Medium

Confidence: 91% confidence
Finding: The scanner includes the `skills/` directory in `SCAN_DIRS`, causing persistent collection of metadata about skill files outside the narrow scope of task-state tracking and agent-declared file paths. In a security-sensitive agent environment, enumerating and persisting metadata about installed skills can reveal tooling inventory and unrelated workspace activity without clear need or disclosure.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill uses strong mandatory language ('MUST be invoked') that can pressure an agent into activating persistent tracking by default without sufficiently objective applicability criteria. In practice, this can normalize unnecessary collection of task names, file paths, and worklog data across many workflows, increasing privacy exposure and the chance of use outside user expectations.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The 'Always on, always recovering' framing encourages broad background use of a persistence mechanism that writes state to disk, even when crash recovery may not be necessary. Security-relevant risk comes from over-collection and habituation: once always-on behavior is normalized, agents may invoke it in contexts involving sensitive filenames, task descriptions, or operational metadata without fresh scrutiny.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The workflow mandates crash-detect/init usage and says not to skip steps, but it does not provide concrete exclusion criteria for harmless, trivial, or privacy-sensitive tasks. That makes the operational boundary ambiguous and can cause an agent to apply persistent logging too broadly, especially because the skill presents itself as foundational safety infrastructure rather than an optional data-processing tool.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: `status()` performs metadata collection as a side effect without warning at the point of use, so a user asking for status may unknowingly trigger filesystem inspection. Even though only metadata is read, the hidden behavior weakens informed consent and can expose file names and activity patterns that the user did not expect to be captured.

Static analysis

No suspicious patterns detected.