Security audit
Security checks for vulnerabilities and agentic risk
This migration skill needs review because its formatting advice and manual history-editing instructions can cause data loss.
Keep independent backups of the workspace and WorkBuddy data. Use an existing compatible destination and avoid the manual history-rewrite command until corrected. Formatting erases the selected volume. Review the dry run before approving changes, and do not rely on the bundled rollback as a complete backup restore.
The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
The FAT32 guidance recommends formatting the destination without explaining that formatting erases existing volume contents. In a data-preserving migration workflow, following this advice could destroy unrelated destination-drive data even though the source workspace remains intact.
When JSON conversion throws a terminating error, the catch block emits the original line, but execution then unconditionally emits the invalid replacement as well. Set-Content persists both, potentially corrupting conversation history precisely when validation is supposed to protect it.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"/R:2", "/W:2", # 失败重试 2 次，每次等 2 秒
"/NFL", "/NDL", "/NJH", "/NJS", "/NP",
]
proc = subprocess.run(cmd, capture_output=True, check=False)
out = (proc.stdout or b"").decode("mbcs", errors="replace")
err = (proc.stderr or b"").decode("mbcs", errors="replace")
# robocopy: 0-7 都算成功（1=有文件被复制，2=有额外项，3=1+2）
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if os.name != "nt":
return []
try:
out = subprocess.run(
["tasklist", "/FO", "CSV", "/NH"],
capture_output=True, timeout=25, check=False,
).stdout
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
def save_json(path: Path, data, indent: int = 2) -> None:
path.parent.mkdir(parents=True, exist_ok=True)
tmp = path.with_suffix(path.suffix + ".tmp")
with open(tmp, "w", encoding="utf-8", newline="\n") as f:
json.dump(data, f, ensure_ascii=False, indent=indent)
os.replace(tmp, path)
The module documentation at L004 promises a purely read-only preflight that writes no files, and L210 repeats the read-only label. However, L218–L220 call C.save_json with a user-supplied output path when --json is provided. Although this export is explicitly documented and appropriate for migration planning, it contradicts the unconditional no-file-writes assurance.