Security audit

Time Capsule 🔮

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its time-capsule purpose, but it stores intimate messages and inferred context persistently, schedules future agent runs, and searches broad memory without clear consent or scope controls.

Review this skill carefully before installing. It is not trying to exfiltrate data or run hidden code, but it is designed to keep personal messages for long periods, schedule future agent activity, enrich capsules with surrounding conversation context, search your memories later, and save replies to memory. Avoid using it for secrets, regulated information, or highly sensitive personal content unless you are comfortable with local plaintext retention and broad memory-based reflection.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:76
Finding: Overbroad Collection and Retrieval of Conversation History
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:33
Finding: Plaintext Persistence of Sensitive Capsule and Conversation Data
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:202
Finding: Automatic Persistence of Untrusted Replies into Long-Term Memory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 89% confidence
Finding: The skill is explicitly designed for session persistence, storing messages for later retrieval and delivery. Persistent storage is not inherently malicious here, but it becomes security-relevant because the retained content is likely intimate and the description does not prominently communicate persistence, making accidental long-term retention of sensitive personal data more dangerous.
Content: Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.
md
description: >- Create, manage, and open time capsules — seal a thought, feeling, decision, or wish and have it delivered back to your future self with AI reflection on what changed. Use when: user wants to seal/capsule/bury a message for their future self, write a letter to future me, record a moment to revisit later, open a time capsule that has arrived, list or manage existing capsules. Trigger phrases: "time capsule", "seal this", "letter to future me", "bury this thought",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill persistently stores highly personal user content verbatim along with derived metadata such as context snapshots, recent topics, mood, and query hints in a local JSON file. Because the description does not clearly warn users that intimate content will be retained outside the immediate session, users may disclose sensitive information without informed consent, increasing privacy and data exposure risk if local state is accessed by other components or users on the system.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: Automatically creating a durable state file enables long-term retention without a fresh confirmation step and expands the attack surface for local data disclosure. In context, this is functional rather than malicious, but the combination of auto-created storage and emotionally sensitive content increases privacy risk if the host environment is shared or insufficiently protected.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
md
- `recentTopics`: 2-3 broad themes from recent conversations - `cronJobId`: matching cron job name for cleanup on delete Create file with `{ "version": 1, "capsules": [] }` if it doesn't exist. ## Seal Flow

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill creates a background cron task that later re-reads stored capsule data and performs memory-based reflection using personal history, but it does not provide an explicit warning about this delayed automated processing. This creates a consent and privacy problem because users may think they are only saving a note, while the system is actually scheduling future autonomous handling of sensitive personal data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The open-flow instructions prescribe different reflection lengths for Chinese and English, which imposes locale-specific handling in the skill behavior. The file does not explain this language constraint or offer the user a choice, so it is a minor natural-language policy issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.