Chronicle

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but it gives the agent broad access to current and historical screen activity without clear per-use user control.

Install only if you are comfortable with an agent using Chronicle to inspect your current screen, recent screen history, OCR-derived text, multiple displays, and persisted screen-summary memories. Prefer using it only after explicit requests, and avoid enabling it around credentials, private messages, customer data, or sensitive documents.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Overbroad Automatic Access to Screen History and Persistent Memories

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4-18 and 38-52
Vulnerability Type: Excessive access to sensitive screen recordings and persistent user context
Risk Level: Medium

Vulnerable Instructions

markdown

Allows you to view the user's screen as well as several hours of history. Use when the user makes a reference to their recent work, for which it'd be helpful to see the screen. This skill MUST be used whenever you need to resolve ambiguity in a user request, where the user hasn't specified enough context to do the task. Examples include disambiguating the specific user/app/document/error the user is referring to.

You must also use this skill if the user asks about any question regarding Chronicle or asks what you can see from the screen.

markdown

This skill allows you to view the user's screen. This skill is enabled because the user has enabled the Codex screen recording (Chronicle) feature, which records a rolling buffer of the past several hours of work to `$TMPDIR/chronicle/screen_recording`.

markdown

1. Only use this skill if memories are available in this rollout. This will manifest as an explicit mention of a ## Memories section in a Developer Message. If this section is not present, do not use this skill. If the user specifically tried to invoke this skill, you can mention it's disallowed because memories are disabled; otherwise, do not mention the existence of this skill (this skill is only supposed to be used when memories are enabled in Codex).
2. Ensure Chronicle is running on the user's computer. You can check this by checking the pidfile at `$TMPDIR/codex_chronicle/chronicle-started.pid` is valid (i.e., exists and process is running). If the pidfile is invalid, do not use this skill. This applies EVEN IF there are seemingly-fresh videos in the screen_recording folder; the user may have just recently disabled Chronicle. Regardless, the takeaway is that recordings *c
...[truncated 4684 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction that Chronicle must be used whenever the agent perceives ambiguity.
2. Require explicit, task-specific user approval before accessing live frames, historical recordings, OCR sidecars, or persistent Chronicle memories.
3. Present the requested access scope before invocation, including the display, application, time range, and type of data to be inspected.
4. Default to the narrowest possible source, such as one current frame from one approved display. Expand to historical frames or other displays only after additional confirmation.
5. Restrict OCR searches to user-approved terms and time windows. Prevent broad searches across all recorded activity.
6. Do not access persistent memory summaries unless the user explicitly requests historical context that requires them.
7. Detect and redact likely credentials, authentication tokens, personal information, and unrelated private content before using or retaining screen-derived data.
8. Require separate confirmation before using screen-derived identifiers to access connectors, applications, or filesystem resources.
9. Maintain an auditable record of what Chronicle sources were accessed, why access was necessary, and what scope the user approved.
10. Preserve the existing availability and freshness checks, but treat them as supplemental controls rather than substitutes for consent and least-privilege enforcement.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill mandates use whenever a request is ambiguous and grants access to the current screen plus several hours of history, which is far broader than what is necessary for most disambiguation. This creates a privacy-sensitive overcollection path where routine clarification scenarios could trigger surveillance of unrelated user activity without a narrowly scoped, explicit user action at the moment of access.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes access to a rolling buffer of several hours of screen recordings and persisted memories but does not present a clear in-skill warning about the sensitivity, retention, and breadth of that data. Without a prominent warning and consent-oriented guidance, an agent may access highly sensitive information—credentials, messages, proprietary documents, or unrelated personal activity—without adequate transparency or user expectation at the time of use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.