Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed wiki-capture helper that reads session material and records selected non-secret decisions or facts, with no executable install code or hidden behavior found.
Before installing, decide which wiki and transcript locations this skill may use, review any scheduled use, and expect it to write only small, sourced, non-secret items after filtering or asking when uncertain.
The skill says to use it when a person says "remember this", "note that", or "put that in the wiki," and also "on a schedule over past agent sessions." Phrases like "remember this" and "note that" overlap with common conversational language, and the schedule-based trigger lacks clear scope constraints, making activation boundaries ambiguous.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
objecting is not a decision. Where a credential is kept is worth filing; the value never
is.
3. **Check each survivor against the wiki** (`wiki-orient`, search step). Already recorded:
skip it. If the session showed the page is wrong or out of date, do not just overwrite
it: follow `wiki-conflicts` (superseded when something changed, corrected when the page
was wrong), which keeps a dated line of the old claim.
4. **File each item with `wiki-record`**: on the page that owns it, smallest edit, dated,
No suspicious patterns detected.