Security audit

CodeBuddy 每日工作日报生成

Security checks for vulnerabilities and agentic risk

Overview

This daily-report skill matches its stated purpose, but it needs review because it broadly scans local work directories and includes assistant session summaries by default.

Install only if you are comfortable with the skill scanning your HOME directory for git repositories, reading CodeBuddy session overview files, and writing a report that may contain sensitive work details. Configure exclusions for private folders, avoid casual invocations, and review the generated output before saving or sharing it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs the agent to execute a Python script, read configuration files, inspect local git repositories, and save a report, yet it declares no permissions. This creates a transparency and consent gap: the skill can access environment data, read files, and invoke shell/git over potentially broad portions of the user's filesystem without an explicit permission contract.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill scans the user's entire home directory and, on Windows, additional drive locations to discover repositories. That is broader filesystem access than necessary for generating a daily report and can enumerate sensitive project locations, hidden workspaces, and unrelated repositories the user did not intend to disclose.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly advertises scanning the entire HOME directory to discover all Git repositories and collecting AI agent session overviews, but it does not warn users about the breadth of data access, possible inclusion of sensitive repositories, or exposure of confidential session content. In a reporting skill, this broad collection is contextually relevant, but the lack of clear scope, consent, and exclusion guidance creates a real privacy and data-minimization risk rather than a purely theoretical concern.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger text includes broad catch-all phrasing such as variations of 'what did I do today/yesterday,' which can cause the skill to activate in contexts where the user did not clearly consent to repository and session-data enumeration. In a skill that performs cross-repository discovery and session summarization, overbroad invocation increases the chance of surprising data collection and disclosure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The overview says the skill automatically discovers all git repositories the user committed to, collects history across all branches, and gathers CodeBuddy Agent session overviews, but it does not prominently warn that this may enumerate and summarize sensitive project and session metadata. Because the collection scope is intentionally broad, missing disclosure reduces informed consent and raises the risk of exposing confidential repository names, commit messages, branch names, and agent-session content.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill directs saving the generated report to the user's workspace or a specified location with a default filename, but it does not warn that this writes potentially sensitive summaries to disk. Reports aggregating commits and agent-session content can create a new artifact that may be synced, indexed, or shared unintentionally if the destination is not chosen carefully.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script reads CodeBuddy session overview files and includes their contents in output without a user-facing warning, opt-in, or minimization. Those overviews may contain proprietary code context, prompts, internal discussions, or other sensitive material that a daily report consumer may not be authorized to receive.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill is explicitly designed to aggregate broad user work activity across repositories and assistant sessions into structured output. In this context, that creates a significant data leakage channel because it centralizes potentially sensitive project history and agent-generated content into a portable report.

Ssd 3

High

Confidence: 98% confidence
Finding: The repository discovery logic is semantically framed to search the entire home directory, including hidden tool directories, for work artifacts. In a reporting skill, this materially increases the danger because it can surface private, incidental, or security-sensitive repositories unrelated to the user's intended reporting scope.

Ssd 3

High

Confidence: 99% confidence
Finding: Reading and exporting overview.md content from agent brain/session storage can leak private assistant conversation summaries, code snippets, and internal reasoning context. Because the script emits this content directly in JSON, downstream consumers may receive far more sensitive information than needed for a daily report.

Static analysis

No suspicious patterns detected.