T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/archiver.py:139- Finding
Predictable Temporary File Allows Symlink-Based File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
Chat Memory Archiver
Security checks for vulnerabilities and agentic risk
Overview
The skill is a local chat-log archiver, but it overstates its sensitive-data protections and can export or persist chat contents without the promised confirmation.
Review before installing. Use this only on session logs you are comfortable archiving, and avoid pointing it at broad directories or logs that may contain passwords, API keys, personal data, private URLs, or security details. Treat generated Markdown or JSON as sensitive until manually reviewed, and avoid writing archives into synced, shared, or version-controlled folders. The /tmp fallback should be removed or gated before production use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/archiver.py:154- Finding
Sensitive Session Content Is Exported Without the Documented Confirmation Gate
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill describes operations that read session logs and write structured exports, but it does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch can lead to overbroad or implicit filesystem access, making it easier for an agent runtime to read unintended files or write extracted sensitive content to unsafe locations. The skill context increases risk because it processes chat logs, which commonly contain secrets, personal data, internal links, and other sensitive material.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The core purpose of this skill is to retain, classify, summarize, and re-export user chat content, including direct line excerpts and topic tags. In the context of a chat-memory archiver, that makes data exposure risk more significant rather than less, because the tool is specifically optimized to preserve and reproduce potentially sensitive conversational material across sessions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script reads arbitrary session logs and extracts/summarizes their contents, then later emits that derived content to stdout or files without any consent prompt, sensitivity warning, or redaction step. Because chat logs commonly contain credentials, personal data, internal URLs, or security discussions, this creates a real privacy and data-handling risk even though it is not an exploit primitive like code execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The tool persists extracted session summaries and category snippets to disk when --outdir is used, but it does not warn that potentially sensitive chat-derived content will be stored. This is dangerous because it turns ephemeral chat content into a durable artifact that may be indexed, backed up, shared, or committed to source control unintentionally.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
When no session files are found, the program silently writes a sample log to /tmp, creating an unexpected filesystem side effect. Although the content is fixed test data rather than user secrets, writing to a shared temporary location without disclosure can violate least surprise and may expose artifacts to other local users depending on system configuration.
- Content
Static analysis
No suspicious patterns detected.