Security audit

agent-chronicle

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent diary generator, but it handles sensitive session history by sending it to an external API and storing derived personal notes in several persistent memory files.

Install only if you are comfortable with session logs and diary context being sent to SkillBoss API Hub and with generated content being written into persistent memory files. Before use, review config.json, disable memory_integration or sensitive sections you do not want retained, prefer --dry-run first, use --no-persistent when appropriate, and avoid exporting HTML if remote stylesheet loading is a concern.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: f.write(content) try: result = subprocess.run([ "pandoc", str(temp_md), "-o", str(output_path),
Confidence: 78% confidence
Finding: result = subprocess.run([ "pandoc", str(temp_md), "-o", str(output_path), "--sandbox", "--standalone", "--metadata", "ti

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The privacy section says all entries are stored locally, but earlier sections state that session-derived diary content is sent to the external SkillBoss API Hub for generation. This is dangerous because users may disclose sensitive session logs, quotes, and relationship notes under a false expectation of purely local processing.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Embedding a remote CDN stylesheet in diary exports is outside the core need of local document generation and introduces unnecessary third-party network interaction. In the context of personal, reflective diary content, this is more dangerous because opening the export can leak metadata and create an avoidable privacy dependency.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is described as diary generation, but it also modifies the broader daily memory log and multiple persistent files containing quotes, curiosities, decisions, and relationship notes. That expands the blast radius from a single generated artifact into long-term memory mutation, which can preserve sensitive or hallucinated content and affect future agent behavior without a clear trust boundary.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README advertises that running generate can automatically trigger setup on first use and that the skill writes journal content to workspace files. In an agent setting, automatic writes without a prominent consent/confirmation step increase the risk of silent data modification and unintended persistence, especially when users may assume generation is read-only.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Enabling memory integration by default causes diary summaries or full entries to be copied into the main memory log, expanding retention and exposure of sensitive content beyond the diary itself. Because diary entries are explicitly emotional and reflective, automatic propagation to another persistent store creates a meaningful privacy and data-handling risk.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list includes common phrases like 'journal', 'quotes', and 'decisions', which are broad enough to activate unintentionally during ordinary conversation. In this skill's context, accidental activation matters because it can read session logs, create persistent records, and potentially send context to an external API without a deliberate request.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation says the script gathers context from session logs and sends it to an external API, but it does not pair this behavior with a clear, immediate privacy warning. Because the gathered context may contain sensitive user communications and internal notes, silent or under-disclosed transmission materially increases confidentiality risk.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger list contains several generic everyday phrases such as "journal," "quotes," "curious," and "decisions" that are likely to appear in normal conversation, increasing the chance of accidental skill activation. In this skill’s context, unintended activation is more concerning because it generates reflective first-person diary content from the agent’s perspective, which could cause unexpected data capture, misleading anthropomorphic output, or unprompted disclosure of recent interaction context into a journal entry.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The script writes the generated PDF directly to a user-supplied or default path without checking whether the file already exists, so existing files can be silently overwritten. In this skill context, the output contains diary data, making accidental destruction or replacement of user files more sensitive than a generic export operation.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: Debug mode writes an additional HTML artifact containing the full diary contents to disk without an explicit warning or consent step. Because this skill handles reflective diary entries, the extra artifact increases privacy and data-retention risk by leaving sensitive content in another easily readable format alongside the PDF.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code loads session logs and persistent diary-related files, combines them into a prompt, and transmits that content to an external API, but there is no explicit user-facing warning or consent step about this disclosure. Because the context can include sensitive agent/user interactions, quotes, decisions, and relationship notes, the privacy impact is substantial and directly tied to the skill's operating context.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The system prompt tells the model to write 'as if no one else will read' the diary, but the output is saved to disk and may be derived from content sent to a third-party API. That framing encourages generation of more intimate and sensitive content under a false privacy assumption, increasing the chance of overcollection and harmful retention.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script creates persistent files for quotes, curiosity items, decisions, and relationship notes that are likely to contain sensitive personal or behavioral data, but it does not provide a clear privacy warning at file-creation time. In this skill context, encouraging reflective diary content from an agent's perspective makes collection of user quotes and relationship dynamics more privacy-sensitive than ordinary note-taking.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list contains generic everyday terms like "quotes," "curious," and "decisions" that are likely to appear in unrelated conversations, increasing the chance of accidental skill activation. In this skill's context, unintended activation is more concerning because it generates first-person reflective diary content, which could inject irrelevant persona-like output into normal agent interactions.

Ssd 3

Medium

Confidence: 86% confidence
Finding: The README encourages preserving subjective experiences, emotions, and memorable interactions as persistent journal content. In an agent skill, this can lead to retention of sensitive user-provided information and conversational details that exceed what is necessary for task completion.

Ssd 3

Medium

Confidence: 91% confidence
Finding: Highlighting memorable things the human said encourages collecting user utterances verbatim into long-lived storage. Verbatim quote capture raises privacy, confidentiality, and downstream disclosure risks because users may not expect their words to be preserved in a separate diary artifact.

Ssd 3

Medium

Confidence: 88% confidence
Finding: Tracking how the human-agent dynamic evolves over time promotes accumulation of longitudinal interaction data and inferred relationship metadata. This creates profiling risk and may expose sensitive behavioral patterns or personal details if logs are accessed, synced, or reused in other contexts.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The Quote Hall of Fame explicitly instructs the agent to collect and retain human quotes, which is a direct persistence mechanism for user content. In context, this is more dangerous because the skill is designed around reflective, personal journaling, making stored excerpts more likely to include sensitive or intimate material.

Ssd 3

Low

Confidence: 80% confidence
Finding: Relationship Evolution promotes ongoing summarization of the human-agent relationship, which can create a persistent profile of interactions over time. The impact is somewhat lower than direct quote storage because it is summarized rather than verbatim, but it still carries privacy and inference risks.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Copying diary content into the main daily memory log broadens distribution of reflective and interaction-derived data, increasing the chance of unintended reuse by other tools or future sessions. This is especially risky when the source diary may contain quotes, emotions, frustrations, and relationship notes that were not meant for wider memory contexts.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The skill is designed to persist quotes, curiosities, decisions, and interaction details in memory files for future reuse. Persistent retention of user-derived content increases the chance of sensitive statements being resurfaced in later prompts, exports, or shared diary entries beyond the user's original intent.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The writing guidance explicitly encourages recording memorable things said by the human and tracking relationship dynamics. In context, this promotes accumulation of personal communication details that may later be echoed into prompts, summaries, memory files, or exports, increasing privacy and confidentiality exposure.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The Quote Hall of Fame feature explicitly instructs persistent storage of things said by the human in a dedicated file. Direct quote retention is particularly risky because it preserves exact user language, which can contain secrets, personal data, or confidential business information that may later be exposed or exported.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Relationship tracking combined with memory integration causes user-derived interaction details to be duplicated across persistent files and appended into broader daily logs. This amplification makes private conversational content easier to rediscover, reuse, export, or inadvertently transmit to external services during later diary generation.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.