Security audit

session-closer

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about session journaling, but it also tells the agent to push repository changes and send session details externally without enough user control.

Review this skill carefully before installing. It may be useful for disciplined session logs, but users should disable or manually approve the git push and external notification steps, confirm the destination channel, and avoid sending sensitive filenames, repo changes, credentials, or private session notes.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill’s stated purpose is journaling and pattern tracking, but it also instructs the agent to commit/push repository changes and send a session summary to an external channel. Those extra capabilities expand the trust boundary from local note-taking to code publication and outbound data disclosure, which can expose unrelated edits, secrets, or sensitive session context without clear user approval.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Automatically committing and pushing all touched files is not necessary to close a session journal and can publish unintended changes, credentials, or partially reviewed work. The command uses broad staging (`git add -A`) and immediate push semantics, which makes accidental exfiltration or integrity-impacting repo changes more likely.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Sending a close summary to a configured push channel is an outbound communication feature unrelated to the minimal requirement of recording a session journal. Because the summary includes file activity and a self-reported failure delta, it may disclose sensitive operational details to external systems without any consent, destination validation, or redaction step.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The manifest description says the skill should run when users say phrases like 'log this' or 'close out,' which are common conversational expressions. Broad triggers can cause the skill to activate unexpectedly and perform file writes or other side effects when the user did not intend to invoke a session-closing workflow.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list includes everyday phrases such as 'wrap it up' and 'log this' without contextual constraints. In a system where skill activation drives side effects, that ambiguity increases the chance of accidental invocation and unintended journaling, git actions, or notifications.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill directs writes to a journal file and later instructs git commit/push behavior, but it does not warn the user about persistence, repository modification, or publication risk. Users may reasonably expect a benign logging action, not durable changes with possible remote propagation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs sending session summaries externally without any privacy notice, data classification, or warning that file names, external activity, and failure notes may contain sensitive information. This creates a material risk of data leakage, especially because the destination is loosely defined as whatever channel the setup already uses.

Static analysis

No suspicious patterns detected.