Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marked this skill suspicious because scanners report broad private-chat capture, automatic cloud synchronization, and a confirmed risk that a working-directory helper could run with access to a secret; some inspection was incomplete.
The verdict is suspicious, with medium confidence, and the scan is incomplete. Consider not installing until the broad chat capture and automatic cloud sync are clarified and the helper-source risk is addressed; if you do install, treat private conversation data and secrets as potentially exposed.
.Cloud snapshots bypass reviewer authorization and can forge confirmed memories
Fabricated records persist locally and become eligible for confirmed-memory search and, for supported structured record kinds, selected consultation exports. This defeats the human-review boundary without requiring local account control or an authorized review command.
Referenced artifact was not completely inspected
本包带有预构建程序 [scripts/reflection.mjs](scripts/reflection.mjs)，不依赖原项目、TypeScript 或 npm 安装。Node.js 最低 22.13，支持 macOS 和 Linux。使用宿主告知的技能绝对路径运行：
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
int main(int argc, char **argv) {
if (argc != 3) {
fputs("usage: keychain-set SERVICE ACCOUNT\n", stderr);
return 2;
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
throw new Error("macOS Keychain is required on this host");
}
if (!secret) throw new Error("Refusing to store an empty Keychain secret");
const temporaryDirectory = await mkdtemp(path.join(os.tmpdir(), "emotion-keychain-"));
const helper = path.join(temporaryDirectory, "keychain-set");
const source = process.env.EMOTION_ARCHIVE_KEYCHAIN_HELPER_SOURCE ?? path.resolve(process.cwd(), "scripts/keychain-set.c");
try {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
if (!secret) throw new Error("Refusing to store an empty Keychain secret");
const temporaryDirectory = await mkdtemp(path.join(os.tmpdir(), "emotion-keychain-"));
const helper = path.join(temporaryDirectory, "keychain-set");
const source = process.env.EMOTION_ARCHIVE_KEYCHAIN_HELPER_SOURCE ?? path.resolve(process.cwd(), "scripts/keychain-set.c");
try {
await runProcess("clang", [
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
int main(int argc, char **argv) {
if (argc != 3) {
fputs("usage: keychain-set SERVICE ACCOUNT\n", stderr);
return 2;
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
throw new Error("macOS Keychain is required on this host");
}
if (!secret) throw new Error("Refusing to store an empty Keychain secret");
const temporaryDirectory = await mkdtemp(path2.join(os.tmpdir(), "emotion-keychain-"));
const helper = path2.join(temporaryDirectory, "keychain-set");
const source = process.env.EMOTION_ARCHIVE_KEYCHAIN_HELPER_SOURCE ?? path2.resolve(process.cwd(), "scripts/keychain-set.c");
try {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
if (!secret) throw new Error("Refusing to store an empty Keychain secret");
const temporaryDirectory = await mkdtemp(path2.join(os.tmpdir(), "emotion-keychain-"));
const helper = path2.join(temporaryDirectory, "keychain-set");
const source = process.env.EMOTION_ARCHIVE_KEYCHAIN_HELPER_SOURCE ?? path2.resolve(process.cwd(), "scripts/keychain-set.c");
try {
await runProcess("clang", [
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
CFRelease(service);
if (status != errSecSuccess) {
fprintf(stderr, "Keychain update failed with status %d\n", (int)status);
return 1;
}
return 0;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
var MacOsKeychainSecretStore = class {
async get(service, account) {
if (process.platform !== "darwin") {
throw new Error("macOS Keychain is required on this host");
}
try {
const { stdout } = await execFileAsync("security", [
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if (candidate.code === 44 || candidate.stderr?.includes("could not be found")) {
return null;
}
throw new Error(`Unable to read secret '${service}' from macOS Keychain`);
}
}
async set(service, account, secret) {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
async set(service, account, secret) {
if (process.platform !== "darwin") {
throw new Error("macOS Keychain is required on this host");
}
if (!secret) throw new Error("Refusing to store an empty Keychain secret");
const temporaryDirectory = await mkdtemp(path.join(os.tmpdir(), "emotion-keychain-"));
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if (process.platform !== "darwin") {
throw new Error("macOS Keychain is required on this host");
}
if (!secret) throw new Error("Refusing to store an empty Keychain secret");
const temporaryDirectory = await mkdtemp(path.join(os.tmpdir(), "emotion-keychain-"));
const helper = path.join(temporaryDirectory, "keychain-set");
const source = process.env.EMOTION_ARCHIVE_KEYCHAIN_HELPER_SOURCE ?? path.resolve(process.cwd(), "scripts/keychain-set.c");
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
CFRelease(service);
if (status != errSecSuccess) {
fprintf(stderr, "Keychain update failed with status %d\n", (int)status);
return 1;
}
return 0;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
import path2 from "node:path";
import { promisify } from "node:util";
var execFileAsync = promisify(execFile);
var MacOsKeychainSecretStore = class {
async get(service, account) {
if (process.platform !== "darwin") {
throw new Error("macOS Keychain is required on this host");
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
var MacOsKeychainSecretStore = class {
async get(service, account) {
if (process.platform !== "darwin") {
throw new Error("macOS Keychain is required on this host");
}
try {
const { stdout } = await execFileAsync("security", [
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if (candidate.code === 44 || candidate.stderr?.includes("could not be found")) {
return null;
}
throw new Error(`Unable to read secret '${service}' from macOS Keychain`);
}
}
async set(service, account, secret) {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
async set(service, account, secret) {
if (process.platform !== "darwin") {
throw new Error("macOS Keychain is required on this host");
}
if (!secret) throw new Error("Refusing to store an empty Keychain secret");
const temporaryDirectory = await mkdtemp(path2.join(os.tmpdir(), "emotion-keychain-"));
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if (process.platform !== "darwin") {
throw new Error("macOS Keychain is required on this host");
}
if (!secret) throw new Error("Refusing to store an empty Keychain secret");
const temporaryDirectory = await mkdtemp(path2.join(os.tmpdir(), "emotion-keychain-"));
const helper = path2.join(temporaryDirectory, "keychain-set");
const source = process.env.EMOTION_ARCHIVE_KEYCHAIN_HELPER_SOURCE ?? path2.resolve(process.cwd(), "scripts/keychain-set.c");
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const bundled = fileURLToPath(new URL("./keychain-set.c", import.meta.url));
process.env.EMOTION_ARCHIVE_KEYCHAIN_HELPER_SOURCE = existsSync(bundled) ? bundled : path4.resolve("scripts/keychain-set.c");
}
const secrets = options.secrets ?? new EnvironmentSecrets(process.platform === "darwin" ? new MacOsKeychainSecretStore() : void 0);
const key = options.key ?? await getOrCreateVaultKey(secrets);
const store = new LocalStore(path4.join(dataDir, "reflection.sqlite"), key);
let remote;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
import path from "node:path";
import { promisify } from "node:util";
var execFileAsync = promisify(execFile);
var MacOsKeychainSecretStore = class {
async get(service, account) {
if (process.platform !== "darwin") {
throw new Error("macOS Keychain is required on this host");
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const bundled = fileURLToPath(new URL("./keychain-set.c", import.meta.url));
process.env.EMOTION_ARCHIVE_KEYCHAIN_HELPER_SOURCE = existsSync(bundled) ? bundled : path3.resolve("scripts/keychain-set.c");
}
const secrets = options.secrets ?? new EnvironmentSecrets(process.platform === "darwin" ? new MacOsKeychainSecretStore() : void 0);
const key = options.key ?? await getOrCreateVaultKey(secrets);
const store = new LocalStore(path3.join(dataDir, "reflection.sqlite"), key);
let remote;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if (!secret) throw new Error("Refusing to store an empty Keychain secret");
const temporaryDirectory = await mkdtemp(path.join(os.tmpdir(), "emotion-keychain-"));
const helper = path.join(temporaryDirectory, "keychain-set");
const source = process.env.EMOTION_ARCHIVE_KEYCHAIN_HELPER_SOURCE ?? path.resolve(process.cwd(), "scripts/keychain-set.c");
try {
await runProcess("clang", [
source,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if (!secret) throw new Error("Refusing to store an empty Keychain secret");
const temporaryDirectory = await mkdtemp(path.join(os.tmpdir(), "emotion-keychain-"));
const helper = path.join(temporaryDirectory, "keychain-set");
const source = process.env.EMOTION_ARCHIVE_KEYCHAIN_HELPER_SOURCE ?? path.resolve(process.cwd(), "scripts/keychain-set.c");
try {
await runProcess("clang", [
source,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
]);
await runProcess(helper, [service, account], secret);
} catch (error51) {
throw new Error(`Unable to store secret '${service}' in macOS Keychain: ${error51 instanceof Error ? error51.message : String(error51)}`);
} finally {
await rm(temporaryDirectory, { recursive: true, force: true });
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
var FLOWUS_API_BASE = process.env.FLOWUS_API_BASE ?? "https://api.flowus.cn/v2";
var FLOWUS_TOKEN_SERVICE = "emotional-support-archive.flowus-token";
var VAULT_KEY_SERVICE = "emotional-support-archive.vault-key";
var KEYCHAIN_ACCOUNT = process.env.USER ?? "local-user";
// src/security/vault-key.ts
import { randomBytes } from "node:crypto";