Security audit

Ctx-Lockstep

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for local project context recovery, but it should be reviewed carefully because setup automatically adds a persistent Git hook that records commit metadata.

Install only if you are comfortable with setup modifying Git repositories by adding a post-commit hook. Use it on projects where keeping a local log of commit subjects is acceptable, and review or remove the ctx-lockstep block from .git/hooks/post-commit if you do not want ongoing commit-time logging.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README advertises automatic git hook installation and persistent writes under a project directory, but does not prominently warn that the skill modifies repository behavior and filesystem state. Because this skill's purpose is long-term context management, those side effects are core to operation, which makes undisclosed repository mutation especially risky in sensitive or shared codebases.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation phrases are broad and map to common project-management requests such as taking over a directory, creating a long-term project, resuming work, and saving state. In an agent ecosystem, this can cause the skill to trigger in contexts where the user did not specifically intend filesystem-modifying behavior, increasing the chance of unintended state creation or drift checks.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to read and write project files, manage a workspace registry, and invoke shell commands (`python3` scripts), but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an execution environment may permit broader file-system or shell access than users expect, increasing the risk of unintended modification of project files or registry state.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The documented trigger phrases for project recovery are broad, common conversational terms such as '恢复项目', '进入项目', and '回到项目'. In a context-management skill, this can cause unintended activation and access to stored project context or file paths during normal conversation, leading to confusion, accidental disclosure, or unintended state changes.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: Phrases like 'help me create a new project' or 'create project structure for this task' are generic enough to match many normal planning conversations. This increases the risk that the skill will initialize management structures, register paths, or alter workspace state in contexts where the user only meant to discuss a task at a high level.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrases for restoring or entering a project are very broad and overlap with ordinary conversational requests. In an agent skill, this can cause accidental invocation of project-context operations, leading the assistant to scan registries, inspect directories, or switch workflow state when the user did not intend to activate this skill.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: 文档示例和关键文件名均使用中文，如“00_恢复入口.md”，并以中文用户短语定义恢复流程，但未说明这是面向中文环境的限定设计，也未提供其他语言选项。若该技能面向通用用户，这可能构成语言/locale 约束未获用户选择的政策问题。

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The document defines resume/enter-project trigger phrases such as '恢复项目', '进入项目', and '回到项目' in a broad natural-language way, which can overlap with ordinary conversation. In an agent skill that changes project context and reads project files, ambiguous activation can cause unintended context switching, disclosure of unrelated project metadata, or writes to the wrong project state.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script automatically installs or appends to .git/hooks/post-commit for any detected Git repository without an interactive warning, explicit opt-in, or dry-run mode. Modifying repository hooks changes local execution behavior and creates a persistence mechanism that will run on every future commit, which is security-sensitive even if the current hook only logs commit metadata. In the context of a long-lived context-management skill, this is more dangerous because users may run it on many repositories and not realize ongoing automated code execution has been introduced.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: This markdown template is written entirely in Chinese and includes fixed Chinese headings and instructions, which effectively forces a specific language for skill use. The file does not offer an opt-in language choice or explain a region-specific reason for the locale restriction, matching the policy's language/locale violation criteria.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases for entering or resuming a project are broad natural-language expressions, which can cause the skill to activate project-scoped behavior when the user is speaking informally rather than intentionally invoking this workflow. In a context-management skill, unintended activation can expose unrelated project metadata, read the wrong files, or cause writes/checkpointing under an incorrect project boundary.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The hook automatically records every commit subject into a project-local log file after each commit, but the template text does not prominently warn users that this data collection occurs. Commit subjects often contain ticket names, incident references, customer identifiers, or other sensitive workflow details, so silent logging can create an unexpected privacy and information-retention risk. In this skill's context, the behavior is intentional for session tracking, which makes it less suspicious than exfiltration, but still dangerous if users are not clearly informed and given consent/control.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The README presents the skill instructions and usage entirely in Chinese, which can impose a language constraint on users without explicit opt-in or justification. Under the policy, forcing a specific language without user choice may be a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The description and heading are primarily Chinese with an English translation, but the document does not state that language is configurable or selected based on user preference. Under the policy rule, forcing or assuming a specific language without opt-in can be a natural-language locale violation.

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: The instructions define activation behavior only for specific Chinese phrases and do not indicate that equivalent phrases in other languages are supported or that the language choice is configurable. This can amount to a language-policy constraint without user opt-in.

Static analysis

No suspicious patterns detected.