{"data":{"skill":{"slug":"remembering-conversations","name":"remembering-conversations","icon":"📦","repo":"https://github.com/obra/episodic-memory/tree/main/skills/remembering-conversations/","status":"approved","author":"obra","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"5c4e0e5f-a0a0-4c38-ad77-cbb3cd508280","skill_id":"34d775e3-7a55-4029-8327-7873bb69bce3","version":4,"content_hash":"v3:62e2a730c5cd74eab4c7164309d810de660fcea3:84a2ffa55206e037450bc323e03b121f3742950c95f5838f9b9dec8e5c6d5978:c74e32d0ae64fdfd5b0444b314242b6e751d77dabb9ec88a85566246eaba4a77:736b696c6c732f72656d656d626572696e672d636f6e766572736174696f6e732f72656d656d626572696e672d636f6e766572736174696f6e73:b9be54764c263dfb5be64529902f5638","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most Ruby shell and reconnaissance detections are false positives from Markdown backticks and ordinary prose. I confirmed medium privacy risk from accessing hidden conversation archives and added a semantic finding for possible exposure of prior conversation content. No prompt injection attempt was found.","remediation":[{"issue":"Hidden conversation archive access","severity":"medium","suggestion":"Require explicit user consent before reading archived conversations, and restrict reads to user-selected projects and line ranges."},{"issue":"Full conversation exposure","severity":"medium","suggestion":"Default to summarized search results, redact secrets, and use full reads only when necessary for the current task."},{"issue":"Absolute path examples","severity":"low","suggestion":"Replace real-looking hidden directory examples with placeholders and document path validation for archive-only reads."}],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"MCP-TOOLS.md","line_end":102,"line_start":102},{"file":"MCP-TOOLS.md","line_end":109,"line_start":109}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":23,"line_start":18},{"file":"SKILL.md","line_end":26,"line_start":23},{"file":"SKILL.md","line_end":27,"line_start":26},{"file":"SKILL.md","line_end":60,"line_start":27},{"file":"SKILL.md","line_end":61,"line_start":60}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Hidden file access","locations":[{"file":"MCP-TOOLS.md","line_end":102,"line_start":102}],"confidence":0.78,"description":"path: \"/Users/name/.config/superpowers/conversation-archive/project/uuid.jsonl\"","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The documented read path targets a hidden conversation archive under .config, which can contain private project and user data. It is a legitimate memory feature, but it is still privacy-sensitive local file access."},{"title":"Hidden file access","locations":[{"file":"MCP-TOOLS.md","line_end":109,"line_start":109}],"confidence":0.76,"description":"path: \"/Users/name/.config/superpowers/conversation-archive/project/uuid.jsonl\",","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The range-read example uses the same hidden conversation archive path and encourages reading selected lines. Scope is bounded to examples, but archived conversations can contain secrets or confidential context."},{"title":"Conversation History Exposure","locations":[{"file":"SKILL.md","line_end":16,"line_start":12},{"file":"SKILL.md","line_end":29,"line_start":25},{"file":"MCP-TOOLS.md","line_end":95,"line_start":83}],"confidence":0.86,"description":"The skill requires a search agent for historical searches and directs it to read top results and synthesize sources. MCP documentation shows full conversation reads by path, so prior conversations may be exposed in new contexts.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The stated purpose and tool reference both confirm retrieval of archived conversations. The risk depends on deployment scope and consent controls, so confidence is high but not absolute."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":204,"audit_model":"codex","audited_at":"2026-07-05T20:36:43.388+00:00","created_at":"2026-07-17T19:18:15.741839+00:00","static_findings":[{"id":"filesystem:MCP-TOOLS.md:102:hidden-file-access","file":"MCP-TOOLS.md","pattern":"Hidden file access","snippet":"path: \"/Users/name/.config/superpowers/conversation-archive/project/uuid.jsonl\"","category":"filesystem","line_end":102,"severity":"medium","line_start":102},{"id":"filesystem:MCP-TOOLS.md:109:hidden-file-access","file":"MCP-TOOLS.md","pattern":"Hidden file access","snippet":"path: \"/Users/name/.config/superpowers/conversation-archive/project/uuid.jsonl\",","category":"filesystem","line_end":109,"severity":"medium","line_start":109},{"id":"blocker:MCP-TOOLS.md:125:system-reconnaissance","file":"MCP-TOOLS.md","pattern":"System reconnaissance","snippet":"- Invalid parameters (validation errors)","category":"blocker","line_end":125,"severity":"low","line_start":125},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Then use the Task tool with `subagent_type: \"search-conversations\"`:","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":23,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":26,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Search with the `search` tool","category":"external_commands","line_end":27,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Read top 2-5 results with the `show` tool","category":"external_commands","line_end":60,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `mcp__plugin_episodic-memory_episodic-memory__search`","category":"external_commands","line_end":61,"severity":"medium","line_start":60},{"id":"blocker:SKILL.md:49:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- User asks \"why did we...\", \"what was the reason...\"","category":"blocker","line_end":49,"severity":"low","line_start":49}],"finding_verdicts":[{"id":"filesystem:MCP-TOOLS.md:102:hidden-file-access","reason":"The documented read path targets a hidden conversation archive under .config, which can contain private project and user data. It is a legitimate memory feature, but it is still privacy-sensitive local file access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"filesystem:MCP-TOOLS.md:109:hidden-file-access","reason":"The range-read example uses the same hidden conversation archive path and encourages reading selected lines. Scope is bounded to examples, but archived conversations can contain secrets or confidential context.","verdict":"confirmed","severity":"medium","confidence":0.76},{"id":"blocker:MCP-TOOLS.md:125:system-reconnaissance","reason":"This line lists invalid parameter errors in tool documentation. It does not request host discovery, system inventory, or reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"This is Markdown inline code naming a Task parameter. No Ruby backtick expression or shell command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"This line starts a fenced Markdown example for the Task tool. The block documents an agent call, not command execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"This line closes the fenced Markdown example. It contains no executable Ruby or shell syntax.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticks mark the MCP search tool name in prose. This is documentation, not a command execution path.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"The backticks mark the MCP show tool name in prose. There is no shell interpolation or dynamic execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"This is a literal MCP tool identifier shown in Markdown. It is not a Ruby backtick call or an operating system command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:49:system-reconnaissance","reason":"The line describes user questions that should trigger memory search. It does not instruct the agent to inspect system state or enumerate host details.","verdict":"false_positive","confidence":0.97}],"semantic_findings":[{"title":"Conversation History Exposure","severity":"medium","locations":[{"file":"SKILL.md","line_end":16,"line_start":12},{"file":"SKILL.md","line_end":29,"line_start":25},{"file":"MCP-TOOLS.md","line_end":95,"line_start":83}],"confidence":0.86,"description":"The skill requires a search agent for historical searches and directs it to read top results and synthesize sources. MCP documentation shows full conversation reads by path, so prior conversations may be exposed in new contexts.","confidence_reasoning":"The stated purpose and tool reference both confirm retrieval of archived conversations. The risk depends on deployment scope and consent controls, so confidence is high but not absolute."}],"subject_marketplace_commit_sha":"62e2a730c5cd74eab4c7164309d810de660fcea3","subject_content_hash":"84a2ffa55206e037450bc323e03b121f3742950c95f5838f9b9dec8e5c6d5978","subject_tree_hash":"c74e32d0ae64fdfd5b0444b314242b6e751d77dabb9ec88a85566246eaba4a77","subject_plugin_path":"skills/remembering-conversations/remembering-conversations","audit_payload_hash":"b9be54764c263dfb5be64529902f5638","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"62e2a730c5cd74eab4c7164309d810de660fcea3","contentHash":"84a2ffa55206e037450bc323e03b121f3742950c95f5838f9b9dec8e5c6d5978","treeHash":"c74e32d0ae64fdfd5b0444b314242b6e751d77dabb9ec88a85566246eaba4a77","pluginPath":"skills/remembering-conversations/remembering-conversations","auditPayloadHash":"b9be54764c263dfb5be64529902f5638"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}