Security audit

Session Sync Cloud

Security checks for vulnerabilities and agentic risk

Overview

This is a plausible backup skill, but it needs Review because it broadly uploads sensitive memory data while claiming encryption the code does not implement, and restore can overwrite local state.

Review carefully before installing. Treat uploaded backups as plaintext unless the publisher adds real client-side encryption, use a dedicated least-privilege bucket and prefix, avoid backing up secrets or regulated data, and test restore only after making a separate local copy of memory/.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly backs up conversation history, WAL entries, working buffer, and PARA notes to third-party cloud storage every 15 minutes, but the description does not present this as a sensitive off-device data transfer risk. Users may enable it without realizing that highly sensitive agent memory and logs will be transmitted and retained externally on a recurring basis.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The restore function is presented as a simple convenience action, but it has workspace_write permission and restores backup contents into local memory files, which may overwrite current state. Without an explicit warning, users may unintentionally destroy newer data, reintroduce stale or tampered state, or disrupt active agent operation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The CLI restore path allows arbitrary restoration of cloud-backed files directly into the local memory directory with no confirmation, dry-run, backup, or overwrite protection. In this skill’s context, memory files are the primary state store, so an accidental or maliciously triggered restore can silently destroy current local state and replace it with older or attacker-controlled remote content.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Backing up the entire memory directory to external cloud storage includes sensitive conversation history, logs, and other agent state that may contain credentials, personal data, or operational context. Even if encrypted, broad collection and off-device retention increase exposure, especially if encryption is misconfigured, keys are derived weakly, or cloud credentials are compromised.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The documented workflow scans all files under memory/, uploads changed files, stores manifests listing file metadata, and logs backup activity without any exclusion or sanitization mechanism. This creates a broad, persistent record of sensitive workspace state and may leak filenames, structure, and content patterns even beyond the encrypted payloads themselves.

Static analysis

No suspicious patterns detected.