Security audit

Session Recall

Security checks for vulnerabilities and agentic risk

Overview

This skill locally copies and indexes the user's Copilot session history for recall, and the sensitive behavior is disclosed and aligned with its purpose.

Install only if you are comfortable with Copilot conversation history being duplicated locally into SessionRecall as plaintext files and SQLite data. Do not share that folder or generated context packs, and enable the scheduler only if you want repeated background syncing.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes PowerShell scripts with `-ExecutionPolicy Bypass` and operates on user-local files and environment-derived paths, but it declares only `allowed-tools` and no explicit permissions model for the underlying file read/write and environment access it requires. This creates a real least-privilege and transparency problem: the agent can read from `~\.copilot\session-store.db` and write indexed data under `~\SessionRecall`, which may expose sensitive prior-session content if users are not clearly informed or if the skill is triggered proactively.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The installer launches child PowerShell processes with `-ExecutionPolicy Bypass` for the main script and optional scheduler installer, which suppresses local script execution protections and expands what the installer can run. Even though the invoked scripts are local and path-checked, this is still a real security concern because any tampering with those files or execution in an untrusted environment would run without normal policy barriers, which is broader than necessary for a session-recall indexing skill.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The tool persistently writes session summaries and conversation-derived content to markdown, JSON, and SQLite on disk by default, but the workflow provides no consent prompt, notice, retention control, or sensitivity gating. In a session-recall skill, this is risky because users may not realize potentially sensitive prompts, summaries, entities, and topics are being retained in a long-lived local index that can later be searched or exported.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Raw event text is appended verbatim to JSONL logs, creating durable plaintext copies of user and assistant messages. Because these logs can contain secrets, credentials, proprietary code, or personal data, silent logging materially increases exposure even if the storage is only local.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The sync feature copies another application's session database and imports its contents into this tool's own storage without an explicit disclosure of scope or consequences. Even though the source is local, this is still a cross-store data replication step that can surprise users and broaden the number of places sensitive session content exists.

Ssd 3

Medium

Confidence: 91% confidence
Finding: This code compacts conversation turns into stored session records and later uses them to build reports and recommended context, creating a deliberate retrieval path for prior natural-language content. In a memory/recall skill, that increases the chance that earlier sensitive prompts or responses are resurfaced to downstream consumers in later interactions without sufficient minimization or authorization checks.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The export and report features are explicitly designed to aggregate matched session information and present it back out, which is a direct data re-disclosure mechanism. Even though the current report path favors metadata over full raw turns, it still republishes summaries, titles, topics, and match reasons that may contain confidential information from prior sessions.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The Copilot sync path imports prior session turns from an existing local store, summarizes them, and republishes them into a searchable memory index, increasing discoverability and reuse of sensitive historical content. The skill context makes this more dangerous, not less, because the entire feature is meant to proactively recall past ideas, so resurfacing confidential data is a core operational path rather than an edge case.

Static analysis

No suspicious patterns detected.