contextstable

• Outcome: Pass
• Latest audit: May 28, 2026 · 1:18 PM UTC
• Version: 0.0.2

Overview

This is a coherent local writing-context helper, but users should treat saved sessions, exports, and dependencies with normal privacy and supply-chain caution.

Install this in a virtual environment, pin and review dependency versions before serious use, and expect local files to be created when using save_session, export_story, or configured auto-save. Do not save private manuscripts on shared machines, and do not load session/cache files from untrusted sources.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill documentation demonstrates file persistence capabilities through session save/load and export features, but the metadata declares no permissions. Undeclared file read/write capability creates a trust gap: hosts may install or execute the skill without understanding it can access local storage, which can lead to unauthorized reading of saved data or overwriting files if the implementation is permissive. In this context, the danger is increased because the skill is designed to process long user-provided text and conversation history, which may contain sensitive content that gets stored to disk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This class for prompt/context stabilization also exposes persistent save/load and export functionality, which expands its capabilities beyond the stated purpose and increases the chance of unintended data retention or exfiltration of story/history content. In an agent-skill setting, filesystem write/read features are security-relevant because long text, prompts, anchors, and generation history may contain sensitive user data and can be persisted without clear trust boundaries in this file.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Local filesystem persistence is not obviously necessary for 'context-stable continuation' and therefore represents unnecessary attack surface and privacy risk. In this context, saved config/history files can preserve sensitive prompts, generated text, and story state across sessions, making accidental disclosure or misuse more likely.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The code can persist full prompts, generated text, character state, and plot timeline to caller-controlled local paths, which goes beyond the narrowly described purpose of context-stable continuation generation. In an agent environment, this creates a data exposure risk because potentially sensitive user inputs and model outputs may be written to disk without clear scoping, minimization, or consent controls.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The import/export functions allow reading from and writing to arbitrary local file paths, which expands the skill's capabilities beyond text continuation into local filesystem interaction. Even without direct exfiltration code, this increases the attack surface because an upstream agent or user-controlled parameter could cause sensitive local data to be loaded or conversation data to be written to unintended locations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The session-saving logic writes configuration and history to disk with no user-facing warning or consent mechanism visible in this file. Because history likely contains prompts, generated text, anchors, and consistency results, silent persistence can surprise users and create privacy, compliance, or data-leakage issues in environments where agents are expected to be ephemeral.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The embedding cache persists user-derived content representations and timestamps to disk via pickle without any disclosure, consent, retention control, or access protection in this code path. In a long-form writing/context skill, cached embeddings are likely derived from sensitive user prompts or manuscript content, so local persistence can create privacy leakage, forensic recoverability, and unintended cross-session data retention risks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: When auto_save is enabled, each added record may be written to disk automatically, including prompts and generated content, without any visible user disclosure or consent mechanism in this code. In practice, this can silently retain sensitive conversation material and create privacy/compliance issues, especially in shared or multi-tenant execution environments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The serialization routine writes the complete history, including user prompts, generated text, character state, and timeline data, to disk as plaintext JSON. This is dangerous because it stores potentially sensitive or proprietary content in a durable form without minimization, access control, or warning, making accidental disclosure more likely.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The export function can write the full story and original prompts to a chosen file, including in JSON form that preserves chapter-by-chapter prompt/content pairs. That can expose sensitive user instructions or private generated material if exported unintentionally, to an unsafe path, or in an environment where local files are accessible to other processes/users.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

langchain>=0.1.0
langchain-community>=0.0.10
sentence-transformers>=2.2.0
faiss-cpu>=1.7.4

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower-bound version only, so installs may resolve to any newer release, including versions with breaking changes or newly introduced vulnerabilities. In a security-sensitive AI stack, this weakens reproducibility and makes supply-chain risk harder to control and audit.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

langchain>=0.1.0
langchain-community>=0.0.10
sentence-transformers>=2.2.0
faiss-cpu>=1.7.4
pydantic>=2.0.0

• Confidence: 95% confidence
• Finding: Using an unpinned langchain-community version allows dependency resolution to drift over time, potentially pulling in vulnerable or incompatible releases. This is especially risky here because the package family has multiple public advisories and is commonly used to process untrusted text and external data.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

langchain>=0.1.0
langchain-community>=0.0.10
sentence-transformers>=2.2.0
faiss-cpu>=1.7.4
pydantic>=2.0.0

• Confidence: 90% confidence
• Finding: A lower-bound-only requirement for sentence-transformers permits uncontrolled upgrades, reducing build reproducibility and increasing supply-chain exposure. While no specific advisory is cited here, unpinned dependencies still create avoidable security and stability risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

langchain>=0.1.0
langchain-community>=0.0.10
sentence-transformers>=2.2.0
faiss-cpu>=1.7.4
pydantic>=2.0.0

• Confidence: 90% confidence
• Finding: The faiss-cpu package is not pinned to an exact version, so future installs may bring in different code than originally tested. This undermines reproducibility and can silently introduce regressions or security issues through the dependency supply chain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

langchain-community>=0.0.10
sentence-transformers>=2.2.0
faiss-cpu>=1.7.4
pydantic>=2.0.0

• Confidence: 95% confidence
• Finding: An unpinned pydantic dependency can resolve to versions affected by known vulnerabilities or behavioral changes, which is problematic for a library used in data parsing and validation. Since this project likely processes large amounts of model and user-supplied text, parser-layer issues can have outsized impact.

Known Vulnerable Dependency: langchain — 10 advisory(ies): CVE-2023-36258 (langchain arbitrary code execution vulnerability); CVE-2026-45134 (LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust); CVE-2024-2965 (Denial of service in langchain-community) +7 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The project depends on langchain, which the scanner reports as having multiple known advisories including arbitrary code execution and unsafe deserialization issues. In an LLM skill that handles external content and framework integrations, these classes of flaws are highly relevant because they can turn untrusted inputs or remote artifacts into code execution, data exposure, or service compromise.

Known Vulnerable Dependency: langchain-community — 9 advisory(ies): CVE-2024-2965 (Denial of service in langchain-community); CVE-2024-8309 (Langchain SQL Injection vulnerability); CVE-2024-5998 (LangChain pickle deserialization of untrusted data) +6 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: langchain-community is flagged with several serious advisories, including SQL injection, denial of service, and unsafe pickle deserialization. This is particularly dangerous in an AI context because community integrations often connect to databases, files, and remote services, so vulnerable components can expose data, allow code execution, or let attackers crash the service via crafted inputs.

Known Vulnerable Dependency: pydantic — 3 advisory(ies): CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: pydantic is reported with known vulnerabilities including regular-expression DoS and problematic parsing behavior. Because this skill likely validates or structures user/model-generated content, parser-level denial of service can be triggered through crafted inputs, degrading availability and possibly affecting downstream processing reliability.

Static analysis

No suspicious patterns detected.