Security audit

Session Summary

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local session-summary helper with disclosed Obsidian persistence, but its bundled script only prints a hardcoded sample summary and does not actually save anything.

Before installing, understand that the instructions are meant to capture session details into a local Obsidian vault path, so avoid invoking it on sensitive chats unless you want that content summarized locally. Also expect the bundled script to be incomplete unless the skill runner implements the save behavior separately.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description says this skill should automatically generate session summaries and save them to Obsidian for end-of-session use. The code only formats a summary from a fixed, hardcoded sessionData object and outputs it with console.log. Although Obsidian vault path constants are present, there is no file write operation, so the claimed save-to-Obsidian behavior is not implemented. The code also does not inspect real session state or handle the described trigger phrases. This is a material description/behavior mismatch because the primary promised capability—automatic end-of-session capture and persistence to Obsidian—is absent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases include generic terms like 'サマリー' and '終わり', which can appear in ordinary conversation and cause unintended activation. In this skill's context, accidental activation matters because it may collect and persist session content to a local Obsidian vault, creating privacy and data-handling risks without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill describes generating a summary but does not prominently warn that session content may be written to a specific local Obsidian vault path. This weakens informed consent and can lead to unintentional persistence of sensitive discussion content, file names, decisions, or work artifacts on the user's machine.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes automatic generation of session summaries and saving them to Obsidian. In this code, although an Obsidian vault path is defined, no file write occurs; instead the script builds a fixed summary from hard-coded data and prints it with console.log. This is a clear behavior mismatch with the claimed persistence behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The activation examples and trigger phrases are presented only in Japanese, which effectively constrains use to a specific language without stating that this is a deliberate locale-specific skill. There is no indication that users can opt into another language or that the Japanese-only behavior is required by the skill's scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code hardcodes ja-JP in toLocaleTimeString, which imposes a specific language/locale behavior regardless of user preference. This matches the policy category for language or locale constraints without opt-in, and there is no surrounding comment or configuration showing that the locale is optional or region-specific by design.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.