Security audit
Security checks for vulnerabilities and agentic risk
This skill is coherent and not malicious, but it automatically processes sensitive voice and keyboard transcripts with broad scope before user confirmation.
Install only if you are comfortable with HiJavis letting this skill examine completed voice/keyboard units and, on manual use, the last 24 hours of transcripts by default. Review generated cards before confirming them, and disable the skill if automatic transcript-derived cards or chat digests are not acceptable for your recordings.
Referenced artifact was not completely inspected
fier, no route matching. This skill's own agent decides for itself, using this `SKILL.md`, whether the unit is worth acting on; if not, it does nothing (see "Ho
Referenced artifact was not completely inspected
fier, no route matching. This skill's own agent decides for itself, using this `SKILL.md`, whether the unit is worth acting on; if not, it does nothing (see "Ho
Referenced artifact was not completely inspected
node scripts/brainstorming.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/brainstorming.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/brainstorming.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/brainstorming.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/brainstorming.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/brainstorming.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/brainstorming.js fetch [--hours N] [--limit N]
The manifest explicitly states that the dispatcher invokes this skill directly for every completed unit, with no classifier or route matching, and that the skill decides relevance itself. This creates an overly broad automatic trigger surface that can cause unintended processing of unrelated user content, increasing the chance of privacy violations, prompt misuse, and unauthorized downstream actions at scale.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
test('sanitizeId rejects path-traversal userIds (exits non-zero)', () => {
for (const bad of ['../etc/passwd', '..', 'a/../../b', 'foo/bar']) {
const r = runGuard(`d.sanitizeId(${JSON.stringify(bad)})`);
assert.notEqual(r.status, 0, `"${bad}" must be rejected`);
assert.match(r.stderr, /Invalid userId/);
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
test('sanitizeId rejects path-traversal userIds (exits non-zero)', () => {
for (const bad of ['../etc/passwd', '..', 'a/../../b', 'foo/bar']) {
const r = runGuard(`d.sanitizeId(${JSON.stringify(bad)})`);
assert.notEqual(r.status, 0, `"${bad}" must be rejected`);
assert.match(r.stderr, /Invalid userId/);
The README states that the skill listens to conversations and scans recent recordings, but it does not present a prominent privacy warning or consent-focused explanation near the feature description and usage flow. This is dangerous because users may not fully understand that ambient or previously captured audio is being reprocessed, increasing the risk of unexpected collection, summarization, and exposure of sensitive personal information.
The trigger phrases shown are broad and natural-language based, including generic requests like "help me organize my thoughts on this". In a voice-listening app that scans recent recordings, overly broad triggers can cause unintended activation and creation of cards from ordinary conversation, leading to unwanted processing of personal audio and accidental data handoff into chat workflows.
The skill declares broad trigger phrases like 'brainstorm', 'help me organize my thoughts', and direct dispatcher invocation for every completed unit, which increases the chance of accidental activation on ordinary conversation. In this skill's context, unintended activation causes transcript fetching and persistence of a generated to-do card, creating a privacy and consent risk rather than direct code execution.
The skill defaults to fetching the last 24 hours of transcripts, but the user-facing trigger descriptions do not prominently warn that a manual run will analyze that amount of historical data. This creates a meaningful privacy issue because a user may expect only the current note or message to be used, while the skill actually scans a broader transcript window.
The 'When to use' guidance expands activation to vague natural-language requests like organizing thoughts or turning something into a deck, without hard boundaries on what qualifies. Because this skill fetches recent transcripts and may create durable artifacts, ambiguous triggering can lead to processing more user data than the user intended.
The description says source transcripts are pulled and a markdown digest is pushed to an iOS chat channel, but it does not indicate any explicit user warning or consent at the point of transmission. When user-generated content is automatically summarized and sent to another destination, sensitive information may be exposed without the user's informed approval, especially because invocation is also described as automatic for completed units.
The route matching configuration includes broad natural-language phrases such as "brainstorm" and "help me organize my thoughts," which can match ordinary user speech and cause the dispatcher to invoke the brainstorming skill when the user did not explicitly intend that action. Because this skill writes persistent to-do cards and chat digests, overbroad routing can create unintended state changes, noisy automation, and privacy-sensitive transcript processing beyond user expectations.
The prompt "brainstorm this" is short, generic language that can easily overlap with ordinary conversation. The file does not provide additional scope limits, exclusion conditions, or negative examples to clarify when this starter should or should not activate.
The test pins digest content to a mixed English/Chinese string (new card / 新腦力激盪), indicating the skill emits locale-specific text by default. There is no indication here that the user can choose or opt into this language behavior, which violates the language/locale policy criterion.
The module header says this is a 'pure logic library (no network, no stdin, no fs)'. However, later documentation for unionSessions explicitly states that 'push may also be handed the fetch payload's sessions on stdin', meaning stdin-originated data is part of the library's intended processing model. That is an intent/documentation contradiction rather than a mere omission.
The user-facing digest header and confirmation text are fixed to a bilingual English/Chinese format, rather than offering a locale choice or documenting a justified locale constraint. This can violate language/locale policy where skills should not force a specific language presentation without user opt-in.
This JavaScript test file asserts an output header containing both English and Chinese text (Brainstorm — new card / 新腦力激盪). That natural-language expectation enforces a specific locale presentation in the skill output, and the file does not indicate user opt-in or a justified region-specific constraint.
These assertions require the digest header to always render in a fixed English/Chinese bilingual form, regardless of user preference. Under the stated policy, forcing a specific language/locale without opt-in is a natural-language policy concern.
Detected: suspicious.dangerous_exec, suspicious.env_credential_access