Security audit

Model Fallback Retry

Security checks for vulnerabilities and agentic risk

Overview

This retry skill is not malicious, but it keeps raw conversation content on disk and automatically replays it with limited privacy controls.

Install only if you are comfortable with failed prompts and model responses being written to local plaintext JSON files and resent later by a cron job. Review where the queue and logs are stored, restrict local file access, disable or trim verbose logging if possible, and be careful using the clear command because it may delete queued retry work.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README explicitly states that messages are automatically queued, persisted to a local file, resent later, and that installation will create a cron job, but it does not clearly warn users about data retention, duplicate message risks, privacy implications, or automated system modifications. In a messaging/AI integration context, silently storing and replaying user prompts can expose sensitive data and cause unintended repeated actions, making the missing disclosure a real security and safety issue.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README advertises a '#清空' command to clear all pending retry messages but does not warn that this action is destructive and may irreversibly delete queued user data or business-critical messages. In the context of a reliability plugin whose purpose is 'zero message loss,' an undocumented destructive operation creates a meaningful risk of accidental data loss and operational disruption.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly stores the user's original message, session identifier, and model error details in a persistent retry queue and later resends them automatically, but the documentation does not clearly warn users about this retention and replay behavior. In a messaging/agent context, this can expose sensitive prompts or personal data to unintended persistence, delayed processing, and repeated transmission without informed consent or operator awareness.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The plugin stores full user-originated messages and detailed error outputs in a persistent local retry queue under the user's home directory. Because the content is retained in plaintext without minimization, consent, or access controls, it can expose sensitive conversation data to other local users, backups, malware, or later unintended reuse.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The logging routine writes full AI outputs, including a preview and the complete response body, to a persistent JSON file on disk. If model outputs contain secrets, personal data, credentials, or sensitive generated content, this creates a durable plaintext record that expands the exposure surface beyond the live session.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The queue persists `original_message`, `sender_id`, `session_key`, and error details in plaintext JSON on disk without any access control, minimization, or retention protections beyond capped completed/cleared history. If the host is shared, backed up broadly, or logs/archives this directory, sensitive user content and identifiers may be exposed, creating a privacy and data-protection risk.

Ssd 3

Medium

Confidence: 99% confidence
Finding: Across the queueing and logging paths, the plugin persistently records both user messages and full AI outputs for later processing, effectively retaining potentially sensitive conversation content in reusable plaintext form. In an agent skill context, conversations often include private prompts, business data, tokens, or operational details, so durable local storage materially increases confidentiality risk.

Static analysis

No suspicious patterns detected.