Security audit

checkpoint-manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed checkpoint manager that persists workflow state to PostgreSQL and a local SQLite cache, with operational data-handling risks users should manage.

Install this only where checkpoint state is allowed to be stored in the configured PostgreSQL database and local SQLite cache. Do not store credentials, session tokens, regulated data, or sensitive personal data in state_data unless your database, cache, reports, retention, and access controls are explicitly approved for that data.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger description is extremely broad, covering common workflow persistence, crash recovery, cache rebuild, integrity verification, and state persistence scenarios. In an agent ecosystem, such broad matching can cause the skill to be invoked in contexts where users did not intend database-backed persistence, increasing the chance of inappropriate activation and unintended handling of workflow state.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation describes persistent storage of arbitrary `state_data` in PostgreSQL and caching in SQLite, but it provides no warning that secrets, tokens, personal data, or regulated data may be written to disk and transmitted to a database. This is dangerous because operators or downstream agents may persist sensitive material by default, creating confidentiality and compliance risk across both the authoritative store and the local cache.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The rebuild and integrity-verification flows state that cache entries may be cleared and reports written to disk, but they do not warn about operational side effects such as transient cache loss, performance impact, report leakage, or accidental broad-scope actions across a tenant. Without explicit cautions, users may trigger destructive or sensitive maintenance operations without understanding the blast radius.

Static analysis

No suspicious patterns detected.