Security audit
Security checks for vulnerabilities and agentic risk
This is a local memory and reflection helper, but it can persist conversation-derived identity, relationship, question, and reflection data without strong user controls.
Install only if you are comfortable with a skill designed to retain and reuse conversation-derived memory. Before enabling heartbeat reflection, decide where the memory directory should live, inspect the generated files regularly, and avoid feeding it transcripts containing secrets, credentials, private personal details, or sensitive business information unless you have a clear cleanup process.
The skill documents behaviors that rely on environment variables and persistent file writes, but it does not declare any explicit tool scope or permissions boundary. This creates ambiguity about what capabilities the skill expects and may lead to overbroad execution in hosts that default to permissive access, especially given it writes memory and reflection artifacts derived from conversations.
The skill explicitly proposes post-session reflection, memory extraction, and question generation from prior conversations, but it does not warn users that their interaction data may be retained and transformed into persistent memory. This is dangerous because users may reveal sensitive personal, relational, or strategic information without informed consent, and the generated inferences can be more privacy-invasive than raw logs.
The documented file structure includes long-lived stores for identity, relationship memories, pending questions, and optional reflection logs, all of which can contain highly sensitive personal or behavioral data. Without any sensitivity labeling, retention limits, or user-facing warnings, this persistence model increases the risk of unintended disclosure, profiling, and misuse of intimate conversation-derived information.
The manifest and module docstring describe asynchronous reflection, structured memory extraction, and confidence-scored memories. However, the core analyzer is a stub that always returns empty memories/questions/identity updates, so the implemented behavior is largely a local question and identity file manager rather than the described reflection/memory integration system.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
"""Save questions to file."""
ensure_dirs()
with open(QUESTIONS_FILE, 'w') as f:
f.write("# Pending Questions\n\n")
f.write(f"_Generated from reflection. Last updated: {datetime.now(timezone.utc).isoformat()}_\n\n")
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
"""Save identity/self-model."""
ensure_dirs()
with open(IDENTITY_FILE, 'w') as f:
f.write("# Identity\n\n")
f.write(f"_Last updated: {datetime.now(timezone.utc).isoformat()}_\n\n")
The docstring says the function analyzes a session and extracts structured memories, and the surrounding comments describe loading transcripts, sending them to an LLM, and parsing structured output. In reality, the function ignores its input and returns empty placeholder fields, which directly contradicts the stated behavior rather than merely omitting detail.
The reflect flow reads session transcripts and persists derived reflection data to local files without any explicit consent, warning, retention policy, or sensitivity filtering. In a continuity/memory skill, this context makes the issue more dangerous because users are likely to provide highly personal conversation history, which can then be stored on disk and exposed to other local users, backups, or unintended file locations.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
# Save reflection log
reflection_file = REFLECTIONS_DIR / f"{datetime.now().strftime('%Y-%m-%d-%H%M')}.json"
with open(reflection_file, 'w') as f:
json.dump({
"timestamp": datetime.now(timezone.utc).isoformat(),
"analysis": analysis
The storage location is influenced by CONTINUITY_MEMORY_DIR, and subsequent commands write questions, identity, and reflection logs there. The file lacks any explicit warning or confirmation that persistent data may be written to an alternate path based on environment configuration.
No suspicious patterns detected.