Security audit

Checkpoints

Security checks for vulnerabilities and agentic risk

Overview

This skill is an audit checkpoint helper, but it broadly directs agents to persist sensitive AI-session context and possibly upload it without requiring explicit review or consent.

Install only if you want agents to create commit-linked audit checkpoints, and require a local policy that stores only sanitized summaries by default. Review the exact checkpoint payload and destination before it is written, committed, tagged, or uploaded, and do not store secrets, credentials, private system instructions, complete transcripts, or detailed reasoning traces.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

Location: SKILL.md:20
Finding: Sensitive AI Session Data May Be Persisted or Uploaded Without Mandatory Safeguards## Vulnerability Details **File Location**: `SKILL.md`, lines 20-85 **Vulnerability Type**: Sensitive conversation, prompt, reasoning, and metadata collection **Risk Level**: Medium ### Vulnerable Snippet The following is an English translation of the relevant directives in `SKILL.md`: ```markdown ## Content a checkpoint should contain When generating or committing AI code, associate the following information with the commit: | Content | Description | | Prompts | The main user or system prompts that triggered generation; these may be redacted. | | Conversation history | A summary or relevant turns from the conversation. | | Reasoning steps | The model or agent's reasoning chain, attempted approaches, and reasons for selecting the implementation. | | Decision logic | Key decisions and their rationales. | | Metadata | Optionally, token usage, model/version, timestamp, and affected files. | | Associated commit | The corresponding commit hash or branch and pending commit description. | ## Methods for binding the checkpoint to a commit - Maintain checkpoint files in `.checkpoints/` or `docs/checkpoints/`. - Reference the checkpoint file from a commit message or tag. - If a checkpoint tool or service exists, use its API or CLI to upload the content and store a URL or identifier in the repository. { "commit": "abc123...", "timestamp": "ISO8601", "prompts": ["original or summarized user request"], "conversation_summary": "conversation points related to the change", "reasoning_steps": ["step 1", "step 2", "..."], "decisions": ["decision and rationale", "..."], "files_changed": ["path/a", "path/b"], "meta": { "model": "optional", "tokens_used": "optional", "agent_version": "optional" } } ``` ### Technical Analysis The Skill directs an agent to collect and persist prompts, conversation history, reasoning steps, decision logic, and execution metadata. Such m ...[truncated 2276 chars]
Remediation: ## Remediation Suggestions 1. Default to a minimal, high-level change summary rather than complete prompts, conversations, or reasoning traces. 2. Explicitly prohibit collection of hidden reasoning, system instructions, authentication material, private keys, access tokens, session cookies, and complete conversation transcripts. 3. Require explicit user approval before creating, committing, or uploading each checkpoint. 4. Show the exact payload and destination to the user before any persistence or transmission occurs. 5. Apply mandatory secret, personal-data, and proprietary-information detection before storage. 6. Replace sensitive values with irreversible placeholders and record only the minimum information needed for auditability. 7. Keep checkpoint files outside version control by default. If repository storage is required, use restricted access and avoid permanent Git history where possible. 8. Allow external transmission only to explicitly approved destinations using authenticated and encrypted connections. 9. Define retention periods, deletion procedures, access controls, and audit logging for checkpoint records. 10. Document that removing a file from the working tree does not remove it from Git history, and provide a secure history-rewrite and credential-rotation process for accidental disclosures.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill instructs storing and possibly uploading prompts, conversation summaries, reasoning, and metadata tied to commits, but does not require a prominent warning or consent step before doing so. This creates a strong risk of retaining secrets, personal data, proprietary context, or sensitive internal reasoning in repositories, commit metadata, or external systems.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill explicitly normalizes retaining prompts, conversation content, reasoning steps, decisions, and metadata, then associating them with commits. In practice, this can leak secrets, credentials, customer data, internal policies, and sensitive model reasoning into durable artifacts that are searchable, shareable, and potentially pushed to remote repositories or external tools.

Ssd 3

High

Confidence: 99% confidence
Finding: These sections explicitly enumerate prompts, dialogue summaries, reasoning chains, decision logic, and metadata as checkpoint contents, which is direct guidance to retain sensitive interaction data. Because this skill is meant for routine code-generation workflows, the collected data is especially likely to contain private user requests, architectural details, incident context, or embedded secrets.

Ssd 3

High

Confidence: 98% confidence
Finding: The sample schema legitimizes storing raw prompts and reasoning steps as structured fields, making dangerous data retention easy to implement and automate. Once represented in a standard JSON format, this information can be indexed, copied, uploaded, or committed at scale, amplifying exposure and long-term retention risks.

Ssd 3

High

Confidence: 99% confidence
Finding: The workflow directly tells the agent to extract prompts, dialogue, and reasoning from the current conversation and store them, which is a clear data collection and persistence directive. This is more dangerous in context because the agent may perform it automatically during commit workflows, causing sensitive conversational data to be retained without meaningful user awareness at exactly the point where artifacts are often shared.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The activation description is broad enough to trigger whenever the agent writes or commits code, which can cause this skill to run in many normal development flows without an explicit user request. In this skill’s context, over-broad activation is risky because automatic checkpointing captures sensitive prompts, conversation history, and reasoning data and binds them to commits.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The file presents key instructions primarily in Chinese while the metadata description is in English, but it does not tell the user that the skill operates in a specific language or offer an alternative. This can create an implicit language policy issue if users are expected to follow instructions in a language they did not choose.

Static analysis

No suspicious patterns detected.