Back to skill

Security audit

inkos

Security checks for vulnerabilities and agentic risk

Overview

InkOS is a disclosed story-writing and translation tool whose persistence, provider access, and local project files fit its stated purpose.

Before installing, be comfortable with a tool that stores manuscripts and story memory in project files and may send selected content to the LLM, image, search, aggregator, or custom provider you configure. Use environment-backed or Studio-managed secrets, avoid untrusted custom base URLs, and verify the npm package/version you intend to install.

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
Long-form writing still uses the chapter pipeline internally:
- **Input governance**: Architect / Planner / Composer preserve author intent, current focus, outline sections, and relevant truth files instead of injecting everything blindly.
- **Writing**: Writer produces prose with length governance, craft rules, and context selected for the current task.
- **Settlement and review**: Observer / Reflector update runtime state; Auditor checks continuity and quality; Reviser handles critical issues. The default write cycle keeps automatic repair conservative and leaves unresolved issues visible for human or agent follow-up.

Truth files are persisted as schema-validated JSON (`story/state/*.json`) with markdown projections for human readability. SQLite temporal memory database (`story/memory.db`) enables relevance-based retrieval on Node 22+.
Persisted story memory is isolated to its project and book, excludes credentials and unrelated files, and is never reused across projects unless the user explicitly imports material. Users can inspect or delete the owning book/project through Studio or CLI.
Confidence
89% confidence
Finding
The skill describes persistent storage of story state and temporal memory in project files and SQLite, which creates retention of user-provided content across sessions. Although it states memory is project-isolated and excludes credentials, persistence still increases exposure if sensitive user content is ingested, later surfaced unexpectedly, or left behind on shared systems.

Static analysis

No suspicious patterns detected.