T09 · Insecure Skill Coding Practices
Error
- Location
chat_archive.py:205- Finding
Path Traversal Through Unvalidated Conversation Identifier
- Content
View full analysis
- Remediation
View remediation
Security audit
Chat Lift
Security checks for vulnerabilities and agentic risk
Overview
This is a local chat archive tool, but it needs review because crafted archive data can make it write HTML outside the intended folder and inject content into generated pages.
Review before installing. Use only exports you trust, store the archive in a private non-synced directory, do not publish the generated web folder without redaction, and avoid running the archive generator on edited or third-party JSON until filename validation and full HTML escaping are fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
chat_archive.py:122- Finding
Stored HTML Injection Through Unescaped Conversation Metadata
- Content
View full analysis
{html.escape(conv['title'])}
{conv.get('source', 'unknown')} {create_time} {message_count} messages""" ``` Conversation-page metadata generation: ```python{conv.get('source', 'unknown')} {self._format_timestamp(conv.get('create_time', ''))} {len(conv.get('messages', []))} messages``` ### Technical Analysis The generator correctly escapes conversation titles and message content in several locations, but it does not consistently escape other imported metadata. The following values are inserted directly into HTML: - `conv['id']` inside an `href` attribute. - `conv['source']` inside class attributes, data attributes, and text nodes. - Formatted creation and message timestamps inside text nodes. The timestamp formatter returns an invalid timestamp string unchanged when parsing fails. Consequently, a crafted string containing HTML markup remains attacker-controlled when inserted into the page. An identifier containing a quotation mark can terminate the `href` attribute and introduce another attribute, including an event handler. A malformed timestamp can inject an element directly into a text context. Be ...[truncated 1503 chars]- Remediation
View remediation
``` 7. Add regression tests using quotation marks, angle brackets, event-handler attributes, malformed timestamps, and malicious identifier values. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code chunk is an HTML archive generator, not a complete import/search/archive pipeline. It assumes conversations already exist as JSON files under chat-archive/json and simply renders them into static pages with CSS and JavaScript. The search functionality is limited to client-side filtering of conversation cards using title and source metadata; it does not search message bodies, so 'full-text search' is not supported by this code. There is also no code to ingest exports from ChatGPT, Claude, or Gemini, nor any source-format normalization beyond reading preexisting JSON objects. The 'static HTML archive' and 'no server required' parts are consistent, but the declared description overstates the implemented capabilities in this supplied chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code substantially matches the import/export portion of the description: it imports ChatGPT, Claude, and Gemini conversations and converts them into Markdown, HTML, and JSON locally with no server. However, key declared capabilities are missing from the supplied code chunk. There is no full-text search functionality, no real indexing mechanism, and no archive-level static site generation such as an index page or browsing/search interface. The HTML generation is limited to individual conversation pages. Therefore the description overstates the implemented functionality, making this a meaningful description/behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The supplied code is specifically a search component for an existing local archive. It performs full-text search over titles and messages, supports regex/case/date/source/role filtering, and computes basic statistics. Those behaviors partially match the declared 'search' functionality, but the broader declared description promises substantial additional capabilities not present in this code chunk: no code for importing data from ChatGPT/Claude/Gemini, no code for creating or updating archives, no static HTML generation, and no evident format-cleaning/indexing pipeline. Therefore the description overstates what this code actually does, creating a material description-behavior mismatch.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README encourages users to export, index, search, and generate static HTML/Markdown/JSON archives of AI conversations, but it does not prominently warn that those outputs may contain highly sensitive prompts, secrets, personal data, or proprietary information. Because static HTML and markdown archives are easy to copy, sync, publish, or serve accidentally, users may expose confidential content without realizing the risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill clearly describes reading exported conversation files and writing Markdown, HTML, JSON, and archive outputs, but it does not declare any explicit tool scope such as allowed file operations or path restrictions. In an agent ecosystem, undeclared file read/write capability reduces transparency and can permit broader filesystem access than users expect, especially when handling sensitive chat exports.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill encourages users to import entire AI conversation exports and generate local Markdown, HTML, and JSON archives, but the main usage section does not prominently warn that this duplicates potentially sensitive prompts, credentials, personal data, or proprietary material onto disk. That increases the risk of accidental exposure through backups, shared directories, local search indexing, source control commits, or weak file permissions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code generates a static web archive from conversation JSON and writes multiple output files containing chat content, which can affect user privacy if the conversations contain sensitive data. Although the script prints status messages, it does not disclose that private conversation contents will be materialized into browsable HTML files on disk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code prints matched message context from archived conversations directly to the terminal, which can expose sensitive user data from chat history. Although the file documents that it searches archived conversations, it does not include any user-facing warning that results may display private conversation content.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md **USE AT YOUR OWN RISK.** - The author(s) are NOT liable for any damages, losses, or consequences arising from the use or misuse of this software — including but not limited to financial loss, data loss, security breaches, business interruption, or any indirect/consequential damages. - This software does NOT constitute financial, legal, trading, or professional advice. - Users are solely responsible for evaluating whether this software is suitable for
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md **USE AT YOUR OWN RISK.** - The author(s) are NOT liable for any damages, losses, or consequences arising from the use or misuse of this software — including but not limited to financial loss, data loss, security breaches, business interruption, or any indirect/consequential damages. - This software does NOT constitute financial, legal, trading, or professional advice. - Users are solely responsible for evaluating whether this software is suitable for
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This is a code file, so SQP-2 applies to safety-relevant behaviors when they lack user disclosure. The file documents that metadata is included and that JSON preserves full conversation structure, but it does not explicitly warn that exports may contain sensitive timestamps/source details from user conversations, which could affect privacy if archives are shared or stored insecurely.
- Content