Session Wrap-Up Premium

• Outcome: Review
• Latest audit: May 28, 2026 · 3:25 PM UTC
• Version: 1.0.0

Overview

This wrap-up skill has a coherent purpose, but it can automatically stage and push repository changes and contains a command-injection bug in its commit flow.

Review carefully before installing. Do not use this on repositories containing secrets or unrelated work unless git operations are changed to stage only explicit wrap-up files, avoid shell=True, and require confirmation before any push.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

OPEN_LOOPS = NOTES_DIR / "open-loops.md"

def run(cmd):
    res = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    return res.returncode, res.stdout, res.stderr

def ensure_dirs():

• Confidence: 98% confidence
• Finding: The helper uses subprocess.run with shell=True on a free-form command string, which is a classic command-injection sink. In this file, that sink is later fed a git commit command containing user-controlled commit_message data, so an attacker can inject additional shell metacharacters and execute arbitrary commands in the workspace context.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill's documented wrap-up purpose is broader than a normal note-taking task and includes `git add -A` followed by `git push`, which can transmit all modified repository contents, not just wrap-up artifacts. In a session-persistence skill, that context makes the mismatch more dangerous because users may expect local logging but inadvertently publish unrelated or sensitive changes to a remote.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The manifest and tool descriptions do not fully disclose that the skill may log into other skills' files or archive WAL data, which hides the true scope of file access and persistence side effects. Hidden cross-skill writes are risky in a memory-management context because they can alter or retain sensitive agent state outside the files a user expects to be touched.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The wrap_up action accepts arbitrary JSON input for commit_message and interpolates it into a shell command: git commit -m "{message}". Because execution ultimately occurs through shell=True, a crafted message containing quotes or shell operators can break out of the quoted string and run arbitrary commands, followed by a git push that may exfiltrate modified content to a remote.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly states that `git push` is automatic and requires no confirmation, yet it provides no caution about remote transmission, branch targeting, or the possibility of pushing unrelated repository changes. In the context of a persistence/wrap-up skill that may collect session summaries and memory data, automatic network publication materially increases the risk of accidental data exfiltration.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill stages all changes, commits, and pushes to the configured remote without any confirmation or warning. In the context of a session wrap-up skill that operates on a user's workspace and memory files, this increases the chance of unintended publication of sensitive notes, secrets, or attacker-modified files, especially when combined with the command-injection issue.

Session Persistence

Medium

• Category: Rogue Agent

Content

enum: ["append", "replace"]
          default: "append"
      required: ["section", "content"]
    permission: workspace_write
---

# Session Wrap-Up Premium

• Confidence: 85% confidence
• Finding: This skill is explicitly designed for session persistence by writing daily logs, updating MEMORY, and maintaining PARA notes, which creates durable storage of potentially sensitive conversation-derived content. In a wrap-up context, that persistence is expected functionality, but it still poses a security and privacy risk if sensitive data, credentials, or confidential summaries are written without review or minimization.

Static analysis

No suspicious patterns detected.