Security audit

对话历史总结归档

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local conversation archiver, but it stores every conversation persistently without clear opt-out, redaction, or retention controls.

Install only if you intentionally want conversations copied into persistent Markdown files. Use a private archive location, avoid synced or shared note repositories for sensitive work, and disable or avoid the skill for conversations involving credentials, personal information, legal or medical details, proprietary content, or confidential material.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

High

Confidence: 97% confidence
Finding: The skill is configured to trigger on every conversation and to automatically archive content at the end, which removes meaningful user consent and scope limitation. In context, this broad trigger amplifies privacy risk because unrelated, sensitive, or regulated conversations may be persisted without review.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill directs automatic archival to a local notes repository but provides no warning, consent flow, retention guidance, or privacy safeguards. This is dangerous because users may unknowingly store secrets, personal data, or confidential assistant outputs in plaintext files on disk.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill explicitly requires unconditional archival of every conversation, including conversation history and outputs, creating a direct data leakage and retention risk. In this skill's context, the danger is heightened because the archive is intended as routine knowledge management, making sensitive capture systematic rather than exceptional.

Ssd 3

High

Confidence: 99% confidence
Finding: The template mandates storing raw user questions and raw assistant replies without modification, which can directly preserve credentials, personal data, proprietary content, or unsafe outputs in long-lived archives. Verbatim retention increases blast radius because any accidental disclosure of the notes repository exposes full conversation content.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The implementation operationalizes ongoing collection by reading the current conversation and appending it to a daily file, creating cumulative retention over time. This makes incidental exposure more likely and harder to remediate because multiple conversations become concentrated in a single archive artifact.

Static analysis

No suspicious patterns detected.