Security audit
Security checks for vulnerabilities and agentic risk
This skill is coherent, but it should be reviewed carefully because it can create durable, exportable records of conversation content with broad activation cues.
Install only if you intentionally want AI session activity recorded as durable evidence. Use it with explicit start/stop consent, avoid storing secrets or private conversation text in session-log.md, review the log before adding it as an artifact or exporting a .aep package, and be cautious with auto mode or any setup that reads ~/.aep/.secret automatically.
The skill directs creation of a running session-log.md containing key Q&A and decisions and states that the log itself must be preserved. This is particularly dangerous because it operationalizes persistent natural-language transcript retention, which can capture secrets, personal data, credentials, proprietary content, or regulated information and then bind it into durable evidence artifacts.
The skill description uses broad natural-language triggers such as mentions of process recording or conversation ending, which can overlap with ordinary chat and cause the skill to activate unexpectedly. In this skill's context, accidental activation is more dangerous because it can start evidence logging, exporting, or secret-dependent commands without a narrowly scoped user request.
The skill's core behavior is to preserve the creative process as independently verifiable evidence, yet the opening description does not provide a strong upfront privacy warning or clear consent boundary before conversation data is captured and packaged. That is dangerous because users may disclose sensitive information in normal dialogue without realizing it is being persistently logged and exportable.
The skill explicitly aims to store who did what, when, with what inputs, decisions, and intermediate outputs as a hash-linked evidence trail. Even if some fields default to hashed storage, the surrounding workflow encourages retention of rich process metadata that can include sensitive user-provided content, making privacy and data minimization failures likely in real use.
Triggering on generic phrases like '开始吧' or broad session state inference creates ambiguous activation conditions. Because this skill persists session evidence and logs dialogue, an overly permissive trigger can initiate durable data capture when the user only intended ordinary conversation flow, making the context materially more sensitive.
The skill instructs the agent to rely on a secret stored in the user's home directory (~/.aep/.secret) for command execution. Even if framed as convenience, directing an agent toward user-resident secrets increases the chance of implicit secret access or propagation without explicit per-run user consent, which is risky in an adversarial or over-broadly triggered skill.
The activation description is written exclusively around Chinese trigger phrases and conversational cues, with no indication that users may opt for another language or locale. This can be a language-policy issue when a skill effectively assumes one language for activation without documenting choice or justification.
No suspicious patterns detected.
