Security audit

Session Archiver Pro

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed chat-log archiver, but its memory-injection format can turn sensitive or untrusted session text into long-term agent memory without enough safeguards.

Install only if you are comfortable processing potentially sensitive chat logs locally. Review and redact outputs before saving or sharing them, and do not import memory-inject JSON into an agent's long-term memory without human review, source checks, and deletion or expiration controls.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: scripts/archiver.py:116
Finding: Untrusted Dialogue Content Can Be Converted into Role-Free Long-Term Agent Memory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/archiver.py:384
Finding: Predictable Shared Temporary File Allows Symlink-Based File Overwrite
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill describes and operationalizes processing of local session log files and generating outputs that imply file read/write behavior, but it does not declare any tool scope or permissions boundary. This creates ambiguity about what filesystem access the agent may use and increases the chance of over-broad or unintended access when handling user conversations and generated archives.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This skill is specifically designed to extract and persist decisions, preferences, risks, and other conversation-derived memory, which can include highly sensitive personal, business, or security-relevant data. Omitting a privacy warning makes unsafe handling more likely by failing to inform users that session content may be retained, transformed, and stored in durable formats.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly advertises formatting outputs for long-term agent memory injection, which can influence future model behavior across sessions. Without a warning, users may unknowingly inject stale, sensitive, manipulative, or contextually unsafe summaries into persistent memory, leading to privacy leakage or behavioral drift in later interactions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file documents a memory-inject output format that enables direct long-term memory population by an agent, which materially expands the skill's capability beyond simple reporting or archival. In a session-archiving skill, converting extracted chat content directly into agent memory creates a trust-boundary violation: untrusted session text can be transformed into persistent instructions, preferences, or facts, enabling prompt-injection persistence and long-lived context poisoning.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script is explicitly built to read full session logs and extract structured memories, including preferences and risks, without any notice, minimization, or consent workflow. In this skill context, the processed content is likely to include sensitive personal, business, or operational information, so silent transformation and archival increases privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The undocumented "memory-inject" mode extends the tool from passive export into preparing conversation-derived content for downstream agent memory ingestion. That increases the risk of privacy leakage, persistence of sensitive user data, and prompt/data poisoning if untrusted session text is later consumed as trusted memory by another agent or workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Packaging extracted session content into a memory-injection format without a prominent warning is risky because users may unknowingly feed sensitive or adversarial conversation content into long-term agent memory. In this context, preserving preferences, decisions, and knowledge from untrusted chats can amplify privacy exposure and create secondary trust-boundary issues in downstream systems.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The feature is designed to persist and re-inject user preferences and other conversation-derived content into agent memory, which creates a durable channel for both sensitive data retention and memory poisoning. Because session logs are inherently untrusted and may contain manipulative or incorrect statements, turning them into reusable memory increases the chance that future agent behavior will be influenced by malicious or private content.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill description focuses on extracting structured memory from existing AI chat sessions and producing outputs. In self-test mode, the code creates a new file under /tmp, which is a write-side effect not implied by the manifest’s extractor-oriented description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: In self-test mode, the program creates a file on disk at /tmp/_archiver_sample.log. Although this is not destructive, it is a file write operation and there is no prior warning in the help text or module documentation that running the script without arguments will create a temporary file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.