Codebuddy Daily Report

• Outcome: Review
• Latest audit: Jul 8, 2026 · 10:01 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it says, but it gathers a broad amount of local development and assistant-session data with limited user scoping.

Install only if you are comfortable with the skill scanning your home directory for Git repositories and reading CodeBuddy session overview files. Before using it, narrow the search paths, exclude private or unrelated projects, disable or remove session-content collection if not needed, and review generated reports before sharing or committing them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if author:
            cmd.append(f"--author={author}")

        result = subprocess.run(
            cmd, capture_output=True, text=True, timeout=15
        )

• Confidence: 93% confidence
• Finding: This subprocess invocation runs `git log` over attacker-controlled local repositories discovered by broad filesystem scanning. Even without `shell=True`, invoking Git inside untrusted repositories can trigger dangerous Git behaviors, hooks/config interactions, or parsing of hostile repository data, especially when the skill automatically enumerates and processes many repos without trust boundaries.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if author:
            cmd.append(f"--author={author}")

        result = subprocess.run(
            cmd, capture_output=True, text=True, timeout=15
        )

• Confidence: 93% confidence
• Finding: Like the earlier `git log` call, this command executes Git against automatically discovered repositories that may be untrusted. Because the skill scans broadly and processes all matching repos, it increases exposure to malicious repository content and to unintended collection of sensitive local development history.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill instructs the agent to execute a bundled Python script, read configuration files, discover repositories, inspect git history across all branches, and collect CodeBuddy session overviews, but it declares no permissions. That mismatch is a real security issue because the skill performs broad filesystem and shell-based data collection without explicit user-visible permission boundaries, increasing the risk of over-collection of sensitive local data.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The script scans the user's entire home directory and, on Windows, additional developer-like locations on other drives, which is much broader than necessary for generating a daily report. This creates a data-minimization failure: the skill can enumerate unrelated private repositories and hidden workspaces, materially expanding the amount of sensitive local information collected.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The session collector reads and emits up to 3000 characters of each `overview.md` file rather than just metadata or a derived summary. That exposes potentially sensitive assistant-session content, project details, prompts, and internal notes that are not strictly required to identify activity for a daily report.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly advertises scanning the entire HOME directory, collecting commit logs across all branches, and summarizing AI agent session overviews, but it does not give a prominent privacy warning, consent prompt, or clear statement of exactly what data will be accessed and exposed in the generated output. In the context of an agent skill, this broad data discovery can unintentionally surface sensitive repository names, commit messages, branch names, and AI session content from unrelated projects, creating a real privacy and data-minimization risk even if the feature is intended.

Vague Triggers

Low

• Confidence: 81% confidence
• Finding: The configuration explicitly states that the script will scan the entire home directory, including hidden directories, and allows adding external search paths. In the context of a reporting skill that aggregates work across repositories, this broad discovery scope can unintentionally traverse sensitive or unrelated repositories, exposing private project names, commit metadata, or activity outside the user's intended reporting scope.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code silently reads CodeBuddy session overview files and includes their contents in structured output without any user-facing warning or consent checkpoint. In the context of a reporting skill, that lack of disclosure is dangerous because users may reasonably expect commit aggregation, not extraction of assistant-session text from local application storage.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill is explicitly designed to aggregate broad user activity from git repositories and CodeBuddy session overviews into structured JSON. In security terms, that is a local data-collection pipeline whose scope naturally includes sensitive development and assistant-session information, so the skill context makes the behavior more dangerous, not less.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The comments and implementation intentionally broaden collection to the entire home directory and hidden tool directories such as `.qclaw` and `.gongfeng-copilot`. That materially increases the chance of sweeping in sensitive or unrelated repositories and transforms a report generator into a wide local inventory-and-extraction mechanism.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The function is explicitly described as scanning for Agent session overviews and returning their contents in output, which is a direct sensitive-data exposure pattern. Because assistant-session overviews can contain prompts, code context, and operational details, emitting that content for a generic daily report exceeds reasonable user expectations and increases leak risk.

Static analysis

No suspicious patterns detected.