Security audit

TokenSaver

Security checks for vulnerabilities and agentic risk

Overview

This memory and token-saving skill is broadly purpose-aligned, but it has under-disclosed automatic memory indexing, unsafe local persistence, ambiguous install identity, and prompt templates that can steer an agent toward unrelated personal business and health goals.

Review carefully before installing. Do not store secrets, regulated data, private profile files, or agent instructions in this tool unless you accept local duplication and later retrieval. Prefer installing only from a verified, canonical package name and version. Avoid running auto-sync, backup import, or vector-cache functionality until URI path validation, pickle removal, explicit indexing consent, and neutral prompt templates are fixed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: templates/korean_prompts.py:19
Finding: Embedded Agent Goal Hijacking and Persistent Memory Manipulation Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: openviking_korean/vector_store.py:58
Finding: Arbitrary Code Execution Through Unsafe Pickle Cache Deserialization
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: openviking_korean/client.py:143
Finding: Path Traversal Allows JSON Files to Be Written Outside the Context Database
Content: View full analysis
bool: """Context 저장""" # URI에서 파일 경로 생성 path = self._uri_to_path(context.uri) path.parent.mkdir(parents=True, exist_ok=True) # JSON으로 저장 with open(path, 'w', encoding='utf-8') as f: json.dump(context.to_dict(), f, ensure_ascii=False, indent=2) return True ``` ```python def _uri_to_path(self, uri: str) -> Path: """URI를 파일 경로로 변환""" # viking://memories/프로젝트/마케팅.md -> memories/프로젝트/마케팅.json if uri.startswith("viking://"): uri = uri[9:] # viking:// 제거 return self.base_path / f"{uri}.json" ``` The v3 backup importer exposes the same path construction to imported records: ```python for ctx in data.get("contexts", []): try: uri = ctx.get("uri") if not uri: continue existing = self.load(uri) if existing and not merge: skipped += 1 continue self.save(uri, ctx) success += 1 ``` ### Technical Analysis The URI is concatenated with the storage base directory without rejecting absolute paths, `..` components, or platform-specific path separators. `pathlib` does not automatically confine the resulting path to `self.base_path`. A relative URI containing traversal components can escape the database directory. The save operation then creates missing parent directories and opens the destination in write mode, truncating an existing file if present. The `.json` suffix limits the final filename but does not prevent overwriting security-sensitive JSON configuration files or planting JSON files in arbitrary writable directories. The issue exists in both the original client storage implementation and th ...[truncated 1678 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: openviking_korean/auto_sync.py:220
Finding: Automatic Indexing Duplicates Sensitive Agent Memory and Profile Files
Content: View full analysis
AutoSync: """자동 동기화 인스턴스 생성" ...[truncated 3234 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:43
Finding: Conflicting Package Identities Create Dependency-Confusion Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (61)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file repeatedly frames the skill as Korean-specific (for example, 'OpenViking Korean', '한국어 Context DB', and '한국어 특화') but does not indicate that users can opt into another language or that the locale restriction is required for a documented compliance or regional purpose. This matches the policy category for language or locale constraints imposed without user choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README encourages saving arbitrary context data and describes automatic loading of stored memories, but it does not warn users that this content may include sensitive prompts, credentials, personal data, or proprietary business information. In an AI-agent context, silent persistence and later retrieval of memory materially increases the risk of unintentional data retention and exposure across tasks, users, or integrations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The feature list advertises export/import, backup, restore, and migration capabilities without warning that these operations can duplicate, move, or exfiltrate stored context data. For a memory store used by AI agents, portable exports can easily contain sensitive conversational context or internal documents, so undocumented transfer behavior creates a realistic confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill advertises automatic compression, summary-only retrieval, and cleanup behavior as cost-saving features without warning that stored content may be reduced, transformed, or effectively lost for future retrieval. In a memory or persistence skill, this can mislead users into trusting the system with important data and cause integrity or availability loss when summaries replace originals or cleanup routines discard detail.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill states that data is automatically loaded on heartbeat/synchronization without any privacy, integrity, or trust-boundary warning. Automatic background loading can expose users to unintended ingestion of stale, sensitive, or tampered data, especially in an agent context where loaded memory may influence later model behavior or decisions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The module description, function docstring, and imported client are all explicitly Korean-focused, and the user-facing CLI/help text is only in Korean. Under the policy, forcing a specific language without user choice can be a locale/language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The function automatically sends the provided query to an external client (OpenVikingKorean.find) without any notice, consent, or indication of where the data goes. Because queries may contain sensitive prompts, credentials, internal project names, or personal data, this creates a real privacy and data-exfiltration risk, especially since the file description indicates this runs automatically at session start.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The benchmark prepends a hard-coded external workspace path to sys.path before importing modules, which changes Python's import resolution and can cause code to be loaded from an unexpected local directory. If that path is writable by another user or contains tampered modules, running the benchmark executes attacker-controlled code, which is unnecessary risk for a benchmarking script.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file repeatedly frames the skill as Korean-only, including the title 'OpenViking Korean Context' and the statement '한국어 특화' ('specialized for Korean'), but does not indicate that users can choose another language or opt into this locale constraint. This is a natural-language locale policy issue because it imposes a specific language context without documenting user choice or a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The module title and surrounding natural-language content are presented only in Korean, and the imported client name also suggests a Korean-specific implementation. There is no visible opt-in, alternative language option, or justification that this skill is intentionally limited to a Korean locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The document repeatedly describes the product and search behavior as Korean-specific, including 'Korean Context DB for AI Agents' and '한국어 검색', while the rest of the API reference does not offer an explicit language/locale choice or explain that the skill is intentionally region-specific. This can constitute a natural-language locale policy violation when a specific language is imposed without user opt-in or clear justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file describes export(output_path, category) and import_backup(input_path, merge) as backup/restore operations, and later shows backup/restore examples, but it does not include any caution about writing files, restoring data, or possible overwrite/merge effects. Under the markdown criteria for missing user warnings, data-affecting behaviors should disclose risks to user data or system integrity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script reads multiple local profile/memory files and sends their full contents into an external client API without any explicit consent prompt, warning, minimization, or trust-boundary check. Because the files appear to contain identity, memory, and agent context data, this can leak sensitive personal or operational information to a remote service or shared backend if the client is not strictly local.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module persists recent queries, result metadata, and loaded document URIs to a local cache file without any consent, disclosure, or minimization. In this skill's context, queries and retrieved URIs may reflect sensitive user activity, memory contents, or workspace structure, so writing them to disk creates a privacy leak and forensic trail that other local processes or users could read.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The index_workspace function automatically reads MEMORY.md, AGENTS.md, USER.md, and daily memory logs, which can contain sensitive personal or system information. The code comments describe indexing, but there is no user-facing disclosure or warning that these files will be ingested and indexed automatically.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module description and implementation are explicitly Korean-only, and the default configuration hard-codes the language to "ko". The file does not present any user choice or opt-in mechanism for language/locale selection, which violates the policy against forcing a specific language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The fallback configuration sets "language": "ko" automatically when no config file exists. Because there is no accompanying prompt, option, or documented opt-in for locale selection in this file, the skill imposes a language policy choice by default.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The method is documented as a token-saving compression routine with comments stating it keeps only core information and compresses to 50% or less. In reality, it simply slices the first 500 characters and reports a reduction ratio, which does not guarantee semantic compression or any particular reduction threshold.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This Python file contains user-facing natural-language descriptions, docstrings, and comments exclusively in Korean, starting with the module description and continuing throughout the file. Under the policy, forcing a specific language without user opt-in or a clearly documented justification is a language/locale policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The module description repeatedly presents the skill as Korean-specific and the implementation is tailored to Korean tokenization and compression behavior, but there is no natural-language opt-in or policy justification for enforcing this locale. Under the stated policy, forcing a specific language or locale without user choice can be a violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The top-level documentation presents the skill as achieving major token-cost reduction for Korean NLP. However, the save paths persist not only compressed variants but also the uncompressed original in the 'detail' field, meaning the system retains full text rather than operating solely as a reduced-token representation. This is an active contradiction between the stated behavior and the implemented storage model.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The export_fast method reads all stored JSON contexts and writes them to the caller-supplied output_path, which can copy potentially sensitive stored content to a new location. While there is a failure print on exception, there is no confirmation, user-facing notice before the write, or warning comment/docstring explaining that this operation exports accumulated data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The module description and user-visible/docstring text are written entirely in Korean, and the model description explicitly emphasizes Korean support, but there is no indication that language choice is configurable or intentionally limited to a Korea-specific context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Insecure deserialization: pickle.load()

Medium

Category: Dangerous Code Execution
Confidence: 98% confidence
Finding: The code uses pickle.load() on a cache file from the user's home directory without any integrity verification or format restrictions. Pickle is code-executing by design during deserialization, so if an attacker can replace or tamper with ~/.openviking/vectors/embeddings.pkl, opening the cache can lead to arbitrary code execution in the current user's context.
Content: Scanner excerpt · openviking_korean/vector_store.py (reported line 64)May include surrounding context.
python
cache_file = self.cache_dir / "embeddings.pkl" if cache_file.exists(): with open(cache_file, 'rb') as f: data = pickle.load(f) self.documents = data.get('documents', []) self.embeddings_cache = data.get('embeddings', {})

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The comment at L098 says the code is refreshing the embedding for the updated document, but the deletion logic removes self.embeddings_cache[uri]. Elsewhere, embeddings are stored and retrieved by content hash (_get_content_hash(content) at L131 and L201), so this comment-guided intent does not match what the code actually invalidates.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.