Security audit
Security checks for vulnerabilities and agentic risk
This skill stores searchable conversation history locally, and the sensitive behavior is disclosed, scoped, and proportionate to that purpose.
Install only if you want your agent to keep a searchable local archive of session history. Treat the archive as sensitive even with redaction, keep it out of synced/shared folders, review retention settings, and use the no-archive switch or cleanup commands when you do not want history retained.
Referenced artifact was not completely inspected
> | Persist redacted conversation chunks in a local SQLite/FTS5 archive | `session_to_sqlite.py` | owner-only directory (`0700`/`0600` or a protected DACL), fai
Referenced artifact was not completely inspected
> | Persist redacted conversation chunks in a local SQLite/FTS5 archive | `session_to_sqlite.py` | owner-only directory (`0700`/`0600` or a protected DACL), fai
Referenced artifact was not completely inspected
> | Persist redacted conversation chunks in a local SQLite/FTS5 archive | `session_to_sqlite.py` | owner-only directory (`0700`/`0600` or a protected DACL), fai
Referenced artifact was not completely inspected
> | Persist redacted conversation chunks in a local SQLite/FTS5 archive | `session_to_sqlite.py` | owner-only directory (`0700`/`0600` or a protected DACL), fai
Referenced artifact was not completely inspected
> | Persist redacted conversation chunks in a local SQLite/FTS5 archive | `session_to_sqlite.py` | owner-only directory (`0700`/`0600` or a protected DACL), fai
Referenced artifact was not completely inspected
> | Persist redacted conversation chunks in a local SQLite/FTS5 archive | `session_to_sqlite.py` | owner-only directory (`0700`/`0600` or a protected DACL), fai
Referenced artifact was not completely inspected
> | Persist redacted conversation chunks in a local SQLite/FTS5 archive | `session_to_sqlite.py` | owner-only directory (`0700`/`0600` or a protected DACL), fai
Referenced artifact was not completely inspected
> | Persist redacted conversation chunks in a local SQLite/FTS5 archive | `session_to_sqlite.py` | owner-only directory (`0700`/`0600` or a protected DACL), fai
Referenced artifact was not completely inspected
> | Persist redacted conversation chunks in a local SQLite/FTS5 archive | `session_to_sqlite.py` | owner-only directory (`0700`/`0600` or a protected DACL), fai
Referenced artifact was not completely inspected
> | Persist redacted conversation chunks in a local SQLite/FTS5 archive | `session_to_sqlite.py` | owner-only directory (`0700`/`0600` or a protected DACL), fai
Referenced artifact was not completely inspected
> | Persist redacted conversation chunks in a local SQLite/FTS5 archive | `session_to_sqlite.py` | owner-only directory (`0700`/`0600` or a protected DACL), fai
Referenced artifact was not completely inspected
host that loads a standard `SKILL.md`.
Referenced artifact was not completely inspected
host that loads a standard `SKILL.md`.
Referenced artifact was not completely inspected
host that loads a standard `SKILL.md`.
Referenced artifact was not completely inspected
host that loads a standard `SKILL.md`.
Referenced artifact was not completely inspected
host that loads a standard `SKILL.md`.
Referenced artifact was not completely inspected
`CHANGELOG.md`, `SPONSORS.md`, `LICENSE`, `checksums.txt`, `scripts/` (Python
Referenced artifact was not completely inspected
`CHANGELOG.md`, `SPONSORS.md`, `LICENSE`, `checksums.txt`, `scripts/` (Python
Referenced artifact was not completely inspected
`CHANGELOG.md`, `SPONSORS.md`, `LICENSE`, `checksums.txt`, `scripts/` (Python
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
a database copied in from another archive is refused.
- `archive_metadata.app` and full column validation for `session_chunks`.
- `_test_v184.py`: purge-only scope (stray file, foreign database, wrong app, wrong
archive id, legacy archive, symlink, tampered marker) and exclusive-create collision —
16 checks.
## 1.8.3 — 2026-09-09
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| Layer | POSIX | Windows |
|-------|-------|---------|
| archive directory | `chmod 0700` | protected DACL: current user + LOCAL SYSTEM, inheritance removed |
| archive marker | `0600`, atomic `O_CREAT\|O_EXCL\|O_NOFOLLOW` | inherits the protected directory DACL |
| database file | `0600`, created atomically with `O_CREAT\|O_EXCL\|O_NOFOLLOW` | protected DACL granting the file itself (`F`, no `(OI)(CI)`) |
| `-wal` / `-shm` | `0600` after the WAL pragma and again after the final checkpoint | inherits the protected directory DACL |
The file’s human-facing header comments and usage text are written in Chinese, and there is no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
This markdown file contains natural-language text that highlights specific languages ('English and 简体中文') without indicating user choice or broader locale flexibility. Under the policy rule for language/locale constraints, this can be read as a fixed-language presentation rather than an opt-in or justified locale-specific limitation.
The Traditional Chinese section directs users to the English and Simplified Chinese sections for the full procedure instead of providing complete instructions in the selected locale. This effectively privileges specific languages for core usage guidance without asking the user to opt in, which is a natural-language locale policy concern.
The Japanese section tells users to refer to English and Simplified Chinese for the full steps rather than offering complete instructions in Japanese. That imposes a language constraint for essential guidance without an explicit opt-in or justification.