Security audit

conversation-visualizer

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent conversation-summary purpose, but it requests broad authority and contains renderer flaws that could write outside the intended output folder or create unsafe local HTML.

Review before installing. Use it only for sessions you are comfortable summarizing, avoid sensitive chats unless you manually redact them first, and do not let untrusted content choose output slugs or output locations. The publisher should remove unused permissions and harden the renderer path and HTML validation before broad use.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_visual.py:218
Finding: Arbitrary File Write Through Unsanitized Output Slug
Content: View full analysis
/../../target.html`. An absolute slug can also cause `pathlib` path joining to discard the intended output directory. The affected write operations can overwrite an existing HTML file. When `--png` is enabled, the PNG destination is derived from the same unsafe value. ### Attack Path 1. An attacker controls the command-line arguments or persuades the Agent to invoke the renderer with a crafted `--slug`. 2. The attacker supplies a value such as `../../some/writable/target`. 3. The program joins the unvalidated slug with the intended output directory. 4. Path resolution escapes the designated output directory. 5. `write_text()` creates or overwrites the resulting HTML file using the privileges of the process. 6. If `--png` is enabled, Playwright also writes a PNG to the attacker-selected path. Exploitation requires that the destination's parent directory already exist and be writable by the process. ### Impact Assessment An attacker can create or ...[truncated 373 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_visual.py:171
Finding: HTML Attribute Injection Through Unvalidated Checklist Status
Content: View full analysis
{_h(c.get("text", ""))} ' f'{_h(status)}\n' ) html = html.replace("{{checklist}}", checklist) ``` ### Technical Analysis The checklist status is escaped when rendered as visible text through `_h(status)`, but the same value is inserted unescaped into the `class` attribute: ```html ``` The documented schema limits status to `ready`, `pending`, or `blocked`, but the renderer does not enforce that allowlist. Because the summary is model-generated from potentially attacker-controlled conversation content, a malicious or malformed value can contain a quote and break out of the `class` attribute. For example, a status resembling the following can introduce an event handler: ```text pending" onclick="alert(document.location) ``` This produces attacker-controlled markup in the generated local HTML file. Escaping only the visible representation does not protect the earlier attribute context. ### Attack Path 1. An attacker places adversarial content in a conversation being summarized. 2. The local model emits a checklist object with a crafted `status` value, or an attacker directly supplies malicious summary JSON to the script. 3. `render_html()` inserts the raw status into the `class` attribute. 4. The crafted quote terminates the original attribute and introduces a new HTML event attribute. 5. The generated HTML is opened in a browser. 6. The injected handler executes when its triggering event occurs, such as when the user clicks the affected checklist entry. ### Impact Assessment Injected JavaScript can modif ...[truncated 439 chars]
Remediation: View remediation
{_h(c.get("text", ""))} ' f'{_h(status)}\n' ) ``` The allowlist is the primary protection; attribute escaping should remain as defense in depth. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

Location: SKILL.md:10
Finding: Skill Declares Tool Permissions Beyond Its Documented Workflow
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 88% confidence
Finding: The skill instructs the agent to collect full session history, flatten it into a transcript, and inject that raw transcript directly into a model prompt via {{transcript}}. Even though the prompt asks the model to return JSON and the skill says not to include secrets, this is still prompt/data extraction risk because sensitive content from prior conversation can be forwarded wholesale to another model context, where prompt injection or over-broad summarization can expose confidential data in outputs or artifacts.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
{{transcript}}

text
## Output rules - HTML must be self-contained: inline CSS and JS, no external assets. - Include an EN/RU/ZH language switcher and light/dark theme toggle.

Static analysis

No suspicious patterns detected.