Security audit

Context Booster

Security checks for vulnerabilities and agentic risk

Overview

The skill's memory features are coherent, but it asks to capture and persist broad conversation context locally with limited default privacy controls and an inconsistent manual install source.

Review before installing. Use this only if you are comfortable with broad conversation memory being stored locally across sessions, avoid entering secrets or regulated data unless protections are configured, and verify the canonical repository before following any manual install instructions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:10
Finding: Unencrypted Persistence of Complete Conversation Context
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:23
Finding: Manual Installation Instructions Reference an Unverified Placeholder Repository
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The FAQ prominently describes automatic cross-session saving and SQLite persistence, but it does not clearly warn users up front that conversation content is retained on disk by default. This can lead users to unknowingly store sensitive prompts, credentials, or internal data locally, increasing exposure to later compromise by other local users, malware, backups, or forensic access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file documents behaviors that may access or process user conversation history and other contextual data sources, including long-term memory and related files. While it includes accuracy and performance cautions later, it does not warn users about privacy implications, data sensitivity, or the need to avoid exposing confidential information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly describes capturing execution context, compressing conversation history, performing semantic retrieval, injecting prior context, and persisting state in SQLite across sessions, but it does not clearly define consent, retention limits, access controls, deletion, or handling of sensitive data. In an AI assistant context, this can lead to over-collection and cross-session leakage of user prompts, secrets, or sensitive business data, making the omission materially dangerous rather than merely a documentation gap.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file is entirely written in Chinese, including headings, instructions, and operational guidance, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file is entirely written in Chinese, including headings, status labels, and changelog content, with no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. That creates a natural-language locale policy concern under the rule for forced language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file presents all usage instructions and invocation phrases exclusively in Chinese, which can amount to a language policy constraint if users are not offered a language or locale choice. There is no statement that the skill is Chinese-only, region-specific, or that other language options are available.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 31% confidence
Finding: The FAQ states '不会将上下文发送到外部服务器' as a privacy guarantee, but this file also references an external GitHub documentation site. However, the file contains only documentation and no executable code, so there is no concrete code behavior contradicting the claim. This is at most a weak documentation-level inconsistency, not a confirmed intent-code divergence.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: A natural-language policy issue exists when a skill effectively forces a specific language without user opt-in or documented justification. This README is entirely in Chinese and does not indicate that alternative languages are available or that the skill is region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The README exposes a cb clear-cache command, which can affect retained context state, but does not mention possible data loss or irreversible removal of cached information. For markdown guidance, destructive or data-affecting behaviors should be disclosed so users understand the impact before running them.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: All user-facing instructions, usage examples, warnings, and operational guidance are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can constitute a language/locale policy violation when a skill implicitly forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This manifest contains user-facing metadata entirely in Chinese, including the description and author branding, with no indication that the skill offers language selection or is intentionally limited to a Chinese-speaking audience. Per the policy, hard-coding a specific language without opt-in or justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.