Security audit

Collect Session

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a session-memory collector that intentionally stores and summarizes conversations, but its retention and LLM data-sharing implications need careful review before installation.

Install only if you intentionally want session contents and tool-use metadata stored as local memory. Before using it, confirm where the memory directory lives, who can read it, how to delete old records, whether LLM enrichment can be disabled, and which LiteLLM provider receives session text. Avoid using it for sessions containing secrets, credentials, private customer data, or sensitive personal material unless you have explicit redaction and retention controls in place.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly captures every session and writes rich Markdown reports, indexes, and JSONL logs to disk, including turns and tool calls, but it does not prominently warn about the privacy and data-retention implications. This can lead users to persist sensitive prompts, secrets, file contents, or operational data in a searchable location without informed consent or retention controls.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill states that LiteLLM is required for LLM-powered naming and summarization and instructs users to configure an API key, but it does not clearly warn that session contents may be transmitted to the local LiteLLM service and potentially onward to an upstream model provider. Sensitive session data could therefore leave the local session environment during enrichment without explicit disclosure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script sends sampled user session text, tool usage, and session metadata to an external LLM endpoint for enrichment without consent, redaction, or a clear disclosure gate. Even if the default endpoint is localhost, LiteLLM commonly proxies to third-party model providers, so sensitive session content may leave the local system and be exposed to additional services or retention policies.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The documented behavior is to persist complete interaction history and related telemetry into searchable files on disk, creating a durable record of potentially sensitive user content and tool outputs. If the storage path is shared, backed up, synced, or insufficiently permissioned, this materially increases exposure and blast radius from otherwise ephemeral conversations.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The script is explicitly designed to extract user text from sessions, generate summaries/keywords, and persist that material into Markdown files and a JSONL log under a memory directory. This creates durable secondary storage of potentially sensitive prompts, decisions, and metadata, increasing exposure through local compromise, backups, indexing, or accidental sharing.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/hook-handler.ts:33

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/collect-session.mjs:40