Session State Watch

• Outcome: Review
• Latest audit: May 28, 2026 · 9:53 AM UTC
• Version: 1.0.2

Overview

This local session-state watcher is mostly purpose-aligned, but it can automatically rewrite and discard older session history and includes loosely controlled daemon shutdown behavior.

Install only if you are comfortable with a local skill reading and writing SESSION-STATE.md. Before using it, disable or change the auto-truncation logic, add real backups or archival rotation, and avoid --stop-daemon until it uses a PID file. Treat SESSION-STATE.md content from cron or background tasks as untrusted input.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill clearly instructs the user to create and update files, including a tracker JSON and potentially SESSION-STATE.md, but the manifest does not declare corresponding permissions. Undeclared write capability is a security issue because it prevents accurate risk evaluation and can hide state-changing behavior from users and policy engines.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The stated purpose is passive change detection, but the documentation describes materially broader behavior: writing/appending to SESSION-STATE.md, maintaining persistent tracker state, daemon/watch operation, and auto-truncating the monitored file. This mismatch is dangerous because operators may install a seemingly low-risk monitoring skill that actually modifies persisted session state and runs background processes.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The documentation expands a lightweight polling concept into an event-driven watcher and daemonized process. Background monitoring increases attack surface and operational risk because it introduces persistence and long-lived execution not implied by the core description.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: Auto-truncating and rewriting SESSION-STATE.md goes beyond detection and can destroy or alter historical data in a file that may contain important session context. This is dangerous because a monitoring utility should not silently mutate its evidence source, especially in an agent-memory workflow where state integrity matters.

Intent-Code Divergence

Medium

• Confidence: 80% confidence
• Finding: The skill markets itself as not requiring external daemons, yet later offers daemon/watch behavior. Contradictory disclosure is a security concern because users may underestimate persistence, resource consumption, and the monitoring footprint of the installed skill.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill is presented as a change detector, but it also rewrites and truncates SESSION-STATE.md automatically when the file exceeds a threshold. That creates an integrity risk: a monitoring utility unexpectedly mutates the very state it is supposed to observe, which can destroy history, interfere with other agents, and hide evidence of prior actions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Using pkill -f "check_session_state.sh --watch" matches command lines broadly and can terminate unrelated processes whose arguments happen to contain the same text. In shared or multi-agent environments this becomes a denial-of-service risk, especially because the script runs as root-owned workspace tooling.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script truncates and rewrites SESSION-STATE.md as part of normal execution flow without requiring a dedicated confirmation or explicit maintenance mode. This is dangerous because routine checks can silently alter shared session state, causing data loss and unexpected behavior for users or background tasks that rely on the file remaining append-only.

Session Persistence

Medium

• Category: Rogue Agent

Content

bash scripts/check_session_state.sh --watch

# Background daemon
nohup bash scripts/check_session_state.sh --watch --daemon > /tmp/session-state-watch.log 2>&1 &

# Stop daemon
bash scripts/check_session_state.sh --stop-daemon

• Confidence: 78% confidence
• Finding: nohup

Session Persistence

Medium

• Category: Rogue Agent

Content

#!/usr/bin/env python3
"""
Example: How to write SESSION-STATE.md updates from cron tasks.

This pattern allows cron tasks to write results to SESSION-STATE.md,
and the main agent session will automatically detect and read them

• Confidence: 84% confidence
• Finding: write SESSION-STATE.md updates from cron tasks. This pattern allows cron tasks to write results to SESSION-STATE.md, and the main agent session will automatically detect and read them via the session

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.