Security audit

feynman-fsrs-pro

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local study-tutor skill, but it needs review because it embeds database credentials and uses unsafe shell-based Obsidian access.

Install only if you are comfortable granting access to the named local Obsidian vault and PostgreSQL database. Before using it, replace the hardcoded database credentials, restrict the database account to least privilege, avoid untrusted note filenames, patch the Obsidian CLI wrapper to avoid shell:true, and do not run schema.sql against an existing database unless you intend to reset it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill embeds live PostgreSQL connection details, including a plaintext password, directly in documentation. Hardcoded secrets are a real vulnerability because anyone with access to the skill file can reuse them to access, modify, or exfiltrate the study database, and the loopback host does not meaningfully mitigate risk in a local agent environment.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The code invokes a shell through execSync with shell:true and builds the command string by interpolating arguments, which creates command-injection risk if any part of the arguments becomes attacker-controlled. In this skill, OBSIDIAN_VAULT and note paths/concept names flow into CLI arguments, so a crafted vault/file name or future code path using unsanitized input could execute unintended shell commands beyond the intended note-sync behavior.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Exposing a database password in user-visible skill content without any sensitivity warning is effectively secret disclosure, not just a documentation issue. This increases the chance the credential is logged, copied, or reused by other agents or users, enabling unauthorized database access.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The skill is designed to access Obsidian notes, review history, weak points, and other personal study records, but it does not clearly warn the user that personal data will be read and processed. In this context, hidden access to personal notes and learning history creates a privacy and consent risk, especially because the workflow normalizes broad retrieval from multiple data sources.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script unconditionally executes `DROP TABLE IF EXISTS feynman_memory CASCADE`, which can destroy existing data and cascade deletion to dependent objects without any confirmation, backup step, or clear safety guard. In this skill's context, the table is a memory store for review history and scheduling state, so accidental execution could permanently wipe a user's learning records and break dependent database objects.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The skill explicitly instructs persistent storage of natural-language review history, feedback, summaries, and weak points. That creates a real data retention vulnerability because sensitive personal learning data can accumulate indefinitely, be queried later out of context, and expose behavioral or cognitive profiling information if the database is accessed.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The workflow requires recording each user response, generating summaries, and writing weak points and conversation-derived content into persistent storage after every session. In context, this makes the privacy risk more serious because retention is mandatory and tightly coupled to normal operation, increasing the volume and sensitivity of stored data over time.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/database.js:25