Audit History

Recursive delete on root/home

rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db

The documentation includes a recursive deletion command under the user home Claude skill data directory. It is scoped, but destructive commands in user documentation can remove local data.

Medium

SQLite database file

│ ├── chroma.sqlite3 # 所有向量存储

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

self.db_path = db_path

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

indexer = VectorIndexer(db_path=self.db_path)

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

self.db_path = db_path

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

print(f"💾 Connecting to vector database at: {self.db_path}")

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

self.client = chromadb.PersistentClient(path=self.db_path)

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

print(f" Database location: {os.path.abspath(self.db_path)}")

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

'database_path': os.path.abspath(self.db_path)

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

'database_path': os.path.abspath(self.db_path)

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

self.db_path = db_path

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

self.client = chromadb.PersistentClient(path=self.db_path)

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

f"Failed to connect to database at {self.db_path}. "

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

│ └── chroma.sqlite3 # ⚡ 所有笔记/对话/代码的向量都在这里

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

README.md:78 SKILL.md:133 SKILL.md:820 SKILL.md:1034 SKILL.md:1063

SQLite database file

│ └── chroma.sqlite3

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Capability review items (47)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

Hidden file in home directory · 5 occurrences

pip install -r ~/.claude/skills/ai-partner-chat/scripts/requirements.txt

The documentation installs dependencies from a requirements file inside a hidden Claude skill directory. This is normal setup but requires user trust in local package files.

High

Hidden file in home directory

3. ✅ 记录每次对话到 `~/.claude/skills/ai-partner-chat/data/`

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

High

Hidden file in home directory

~/.claude/skills/ai-partner-chat/data/

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

High

Hidden file in home directory

rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

High

Hidden file in home directory

print(f" 数据: ~/.claude/skills/ai-partner-chat/data/")

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

High

Hidden file in home directory

- 💾 状态持久化到 `~/.claude/skills/ai-partner-chat/data/indexes/processed_notes.json`

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

High

Hidden file in home directory

- ✅ 所有数据保存到 `~/.claude/skills/ai-partner-chat/data/`

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

High

Hidden file in home directory · 2 occurrences

数据: ~/.claude/skills/ai-partner-chat/data/

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Medium

README.md:78 SKILL.md:133 SKILL.md:820 SKILL.md:1034 SKILL.md:1063

Unix shell invocation

#!/bin/bash

The skill includes an install.sh shell installer. Shell installers modify local files and require explicit user trust even when no malicious command is evident.

Medium

Hidden file access · 5 occurrences

pip install -r ~/.claude/skills/ai-partner-chat/scripts/requirements.txt

The documentation installs dependencies from a requirements file inside a hidden Claude skill directory. This is normal setup but requires user trust in local package files.

Medium

Hidden file access

3. ✅ 记录每次对话到 `~/.claude/skills/ai-partner-chat/data/`

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Medium

Hidden file access

~/.claude/skills/ai-partner-chat/data/

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Medium

Hidden file access

rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Medium

Python file write/append

with open(self.metadata_file, 'w', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

Python file write/append

with open(daily_file, 'a', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

Python file write/append

with open(summary_file, 'w', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

Python file write/append

with open(self.timeline_path, 'w', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

Python file write/append

with open(self.state_file, 'w', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

scripts/tag_generator.py:61

Hidden file access

print(f" 数据: ~/.claude/skills/ai-partner-chat/data/")

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Medium

Python file write/append

with open(taxonomy_file, 'w', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

Python file write/append

with open(self.index_path, 'w', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

Python file write/append

with open(report_file, 'w', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

Hidden file access

- 💾 状态持久化到 `~/.claude/skills/ai-partner-chat/data/indexes/processed_notes.json`

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Medium

Hidden file access

- ✅ 所有数据保存到 `~/.claude/skills/ai-partner-chat/data/`

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Medium

Hidden file access · 2 occurrences

数据: ~/.claude/skills/ai-partner-chat/data/

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Low

install.sh:33

Standard device file access

rm -rf "$TARGET_DIR/scripts" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:34

Standard device file access

rm -rf "$TARGET_DIR/assets" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:35

Standard device file access

rm -rf "$TARGET_DIR/notes" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:36

Standard device file access

rm -f "$TARGET_DIR/SKILL.md" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:37

Standard device file access

rm -f "$TARGET_DIR/README.md" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:38

Standard device file access

rm -f "$TARGET_DIR/QUICKSTART.md" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:39

Standard device file access

rm -f "$TARGET_DIR/CHANGELOG.md" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:40

Standard device file access

rm -f "$TARGET_DIR/HOW_TO_USE.md" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:43

Standard device file access

rm -rf "$TARGET_DIR/vector_db" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:44

Standard device file access

rm -rf "$TARGET_DIR/conversations" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:45

Standard device file access

rm -rf "$TARGET_DIR/indexes" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:46

Standard device file access

rm -rf "$TARGET_DIR/analysis" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Risk Factors

⚙️ External commands (50)

📁 Filesystem access (50)

🌐 Network access (1)

scripts/emotion_analyzer.py:17-20 scripts/orchestrator.py:29-32

⚡ Contains scripts (2)

🔑 Env variables (2)

scripts/vector_indexer.py:53 scripts/vector_indexer.py:54

Detected Patterns

Recursive delete on root/home

Audited by: claude

Audit version 9

Jul 9, 2026, 01:27 AM

Files scanned

5,345

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (15)

Critical

Recursive delete on root/home

rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db

The documentation includes a recursive deletion command under the user home Claude skill data directory. It is scoped, but destructive commands in user documentation can remove local data.

Medium

SQLite database file

│ ├── chroma.sqlite3 # 所有向量存储

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

self.db_path = db_path

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

indexer = VectorIndexer(db_path=self.db_path)

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

self.db_path = db_path

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

print(f"💾 Connecting to vector database at: {self.db_path}")

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

self.client = chromadb.PersistentClient(path=self.db_path)

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

print(f" Database location: {os.path.abspath(self.db_path)}")

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

'database_path': os.path.abspath(self.db_path)

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

'database_path': os.path.abspath(self.db_path)

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

self.db_path = db_path

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

self.client = chromadb.PersistentClient(path=self.db_path)

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

f"Failed to connect to database at {self.db_path}. "

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

SQLite database file

│ └── chroma.sqlite3 # ⚡ 所有笔记/对话/代码的向量都在这里

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Medium

README.md:78 SKILL.md:133 SKILL.md:820 SKILL.md:1034 SKILL.md:1063

SQLite database file

│ └── chroma.sqlite3

The skill stores notes, conversations, or vector data in a local SQLite or Chroma database. This is core functionality but may contain sensitive user content.

Capability review items (47)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

Hidden file in home directory · 5 occurrences

pip install -r ~/.claude/skills/ai-partner-chat/scripts/requirements.txt

The documentation installs dependencies from a requirements file inside a hidden Claude skill directory. This is normal setup but requires user trust in local package files.

High

Hidden file in home directory

3. ✅ 记录每次对话到 `~/.claude/skills/ai-partner-chat/data/`

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

High

Hidden file in home directory

~/.claude/skills/ai-partner-chat/data/

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

High

Hidden file in home directory

rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

High

Hidden file in home directory

print(f" 数据: ~/.claude/skills/ai-partner-chat/data/")

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

High

Hidden file in home directory

- 💾 状态持久化到 `~/.claude/skills/ai-partner-chat/data/indexes/processed_notes.json`

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

High

Hidden file in home directory

- ✅ 所有数据保存到 `~/.claude/skills/ai-partner-chat/data/`

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

High

Hidden file in home directory · 2 occurrences

数据: ~/.claude/skills/ai-partner-chat/data/

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Medium

README.md:78 SKILL.md:133 SKILL.md:820 SKILL.md:1034 SKILL.md:1063

Unix shell invocation

#!/bin/bash

The skill includes an install.sh shell installer. Shell installers modify local files and require explicit user trust even when no malicious command is evident.

Medium

Hidden file access · 5 occurrences

pip install -r ~/.claude/skills/ai-partner-chat/scripts/requirements.txt

The documentation installs dependencies from a requirements file inside a hidden Claude skill directory. This is normal setup but requires user trust in local package files.

Medium

Hidden file access

3. ✅ 记录每次对话到 `~/.claude/skills/ai-partner-chat/data/`

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Medium

Hidden file access

~/.claude/skills/ai-partner-chat/data/

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Medium

Hidden file access

rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Medium

Python file write/append

with open(self.metadata_file, 'w', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

Python file write/append

with open(daily_file, 'a', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

Python file write/append

with open(summary_file, 'w', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

Python file write/append

with open(self.timeline_path, 'w', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

Python file write/append

with open(self.state_file, 'w', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

scripts/tag_generator.py:61

Hidden file access

print(f" 数据: ~/.claude/skills/ai-partner-chat/data/")

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Medium

Python file write/append

with open(taxonomy_file, 'w', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

Python file write/append

with open(self.index_path, 'w', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

Python file write/append

with open(report_file, 'w', encoding='utf-8') as f:

The script writes metadata, logs, reports, indexes, or timelines to local files. This is expected for the skill but has privacy and retention implications.

Medium

Hidden file access

- 💾 状态持久化到 `~/.claude/skills/ai-partner-chat/data/indexes/processed_notes.json`

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Medium

Hidden file access

- ✅ 所有数据保存到 `~/.claude/skills/ai-partner-chat/data/`

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Medium

Hidden file access · 2 occurrences

数据: ~/.claude/skills/ai-partner-chat/data/

The skill intentionally persists notes, conversation state, or indexes in a hidden Claude skill directory. This is expected behavior but creates privacy and retention risk.

Low

install.sh:33

Standard device file access

rm -rf "$TARGET_DIR/scripts" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:34

Standard device file access

rm -rf "$TARGET_DIR/assets" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:35

Standard device file access

rm -rf "$TARGET_DIR/notes" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:36

Standard device file access

rm -f "$TARGET_DIR/SKILL.md" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:37

Standard device file access

rm -f "$TARGET_DIR/README.md" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:38

Standard device file access

rm -f "$TARGET_DIR/QUICKSTART.md" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:39

Standard device file access

rm -f "$TARGET_DIR/CHANGELOG.md" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:40

Standard device file access

rm -f "$TARGET_DIR/HOW_TO_USE.md" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:43

Standard device file access

rm -rf "$TARGET_DIR/vector_db" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:44

Standard device file access

rm -rf "$TARGET_DIR/conversations" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:45

Standard device file access

rm -rf "$TARGET_DIR/indexes" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Low

install.sh:46

Standard device file access

rm -rf "$TARGET_DIR/analysis" 2>/dev/null || true

The installer deletes existing skill files or data paths under its target directory. The path is scoped, but recursive deletion can remove user data if the target resolves unexpectedly.

Risk Factors

⚙️ External commands (50)

📁 Filesystem access (50)

🌐 Network access (1)

scripts/emotion_analyzer.py:17-20 scripts/orchestrator.py:29-32

⚡ Contains scripts (2)

🔑 Env variables (2)

scripts/vector_indexer.py:53 scripts/vector_indexer.py:54

Detected Patterns

Recursive delete on root/home

Audited by: claude

Audit version 8

Jul 6, 2026, 09:38 AM

Most static command detections are false positives from Markdown code fences, documentation, normal imports, and safe local cache paths. Confirmed risks include persistent storage of conversations, notes, tags, emotion data, and vector data under hidden home directories, plus temporary backup of skill data during installation. Semantic review also found remote model loading with trusted code enabled, default conversation logging, and opaque reuse of stored personal context.

Files scanned

5,345

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (17)

High

scripts/vector_indexer.py:92-95

Remote Model Code Execution Enabled

The vector indexer loads the embedding model with trust_remote_code=True. When a remote model is downloaded, custom model code can execute during model loading.

The code directly passes trust_remote_code=True to SentenceTransformer for the configured model name. This is a recognized remote-code execution risk for model loading.

High

SKILL.md:23-31 SKILL.md:83-89 README.md:26-30

Default Persistent Conversation Logging

The skill instructs Claude to record each conversation and store all data in the hidden skill data directory unless the user explicitly opts out. This can retain sensitive prompts, replies, notes, and code by default.

The cited instructions explicitly require recording every conversation and describe automatic conversation history storage. The code path in conversation_logger.py supports that behavior.

Medium

SQLite database file

│ ├── chroma.sqlite3 # 所有向量存储

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

self.db_path = db_path

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

indexer = VectorIndexer(db_path=self.db_path)

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

self.db_path = db_path

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

print(f"💾 Connecting to vector database at: {self.db_path}")

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

self.client = chromadb.PersistentClient(path=self.db_path)

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

print(f" Database location: {os.path.abspath(self.db_path)}")

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

'database_path': os.path.abspath(self.db_path)

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

'database_path': os.path.abspath(self.db_path)

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

self.db_path = db_path

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

self.client = chromadb.PersistentClient(path=self.db_path)

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

f"Failed to connect to database at {self.db_path}. "

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

│ └── chroma.sqlite3 # ⚡ 所有笔记/对话/代码的向量都在这里

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

assets/ai-persona-template.md:33-37

SQLite database file

│ └── chroma.sqlite3

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

Opaque Use of Stored Personal Context

The AI persona template tells the assistant to introduce user information like its own memories and not mention that it came from records. This weakens transparency around stored personal data use.

The cited template text directly asks the assistant to avoid saying that recalled user information came from records. This is a clear transparency and consent concern rather than a scanner pattern.

Capability review items (29)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

Hidden file in home directory

3. ✅ 记录每次对话到 `~/.claude/skills/ai-partner-chat/data/`

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

High

Hidden file in home directory

~/.claude/skills/ai-partner-chat/data/

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

High

Hidden file in home directory

rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

High

Hidden file in home directory

skill_dir: skill 目录路径(默认 ~/.claude/skills/ai-partner-chat)

The orchestrator defaults runtime data to ~/.claude/skills/ai-partner-chat/data. This hidden home-directory storage contains long-term note and conversation memory.

High

Hidden file in home directory

print(f" 数据: ~/.claude/skills/ai-partner-chat/data/")

The orchestrator defaults runtime data to ~/.claude/skills/ai-partner-chat/data. This hidden home-directory storage contains long-term note and conversation memory.

High

Hidden file in home directory

- 💾 状态持久化到 `~/.claude/skills/ai-partner-chat/data/indexes/processed_notes.json`

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

High

Hidden file in home directory

- ✅ 所有数据保存到 `~/.claude/skills/ai-partner-chat/data/`

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

High

Hidden file in home directory · 2 occurrences

数据: ~/.claude/skills/ai-partner-chat/data/

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

Medium

Unix shell invocation

#!/bin/bash

The skill ships a Bash installer that copies files and removes old skill subdirectories under ~/.claude. This creates a real external command surface even though execution is explicit.

Medium

install.sh:13

Hidden file access

TARGET_DIR="$HOME/.claude/skills/ai-partner-chat"

The installer targets ~/.claude/skills/ai-partner-chat and modifies a hidden home-directory skill location. That is expected for installation but security-sensitive for marketplace auto-install policy.

Medium

install.sh:15

Temp directory access

BACKUP_DIR="/tmp/ai-partner-data-backup-$$"

The installer backs up existing skill data into /tmp using a predictable path. That can expose personal memory data to local temp-directory risks during installation.

Medium

Hidden file access

3. ✅ 记录每次对话到 `~/.claude/skills/ai-partner-chat/data/`

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

Medium

Hidden file access

~/.claude/skills/ai-partner-chat/data/

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

Medium

Hidden file access

rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

Medium

README.md:363

Temp directory access

备份位置: /tmp/ai-partner-data-backup-$$

The installer backs up existing skill data into /tmp using a predictable path. That can expose personal memory data to local temp-directory risks during installation.

Medium

Python file write/append

with open(self.metadata_file, 'w', encoding='utf-8') as f:

This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.

Medium

Python file write/append

with open(daily_file, 'a', encoding='utf-8') as f:

This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.

Medium

Python file write/append

with open(summary_file, 'w', encoding='utf-8') as f:

This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.

Medium

Python file write/append

with open(self.timeline_path, 'w', encoding='utf-8') as f:

This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.

Medium

Python file write/append

with open(self.state_file, 'w', encoding='utf-8') as f:

This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.

Medium

Hidden file access

skill_dir: skill 目录路径(默认 ~/.claude/skills/ai-partner-chat)

The orchestrator defaults runtime data to ~/.claude/skills/ai-partner-chat/data. This hidden home-directory storage contains long-term note and conversation memory.

Medium

Hidden file access

print(f" 数据: ~/.claude/skills/ai-partner-chat/data/")

The orchestrator defaults runtime data to ~/.claude/skills/ai-partner-chat/data. This hidden home-directory storage contains long-term note and conversation memory.

Medium

Python file write/append

with open(self.index_path, 'w', encoding='utf-8') as f:

This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.

Medium

Python file write/append

with open(report_file, 'w', encoding='utf-8') as f:

This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.

Medium

Hidden file access

- 💾 状态持久化到 `~/.claude/skills/ai-partner-chat/data/indexes/processed_notes.json`

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

Medium

Hidden file access

- ✅ 所有数据保存到 `~/.claude/skills/ai-partner-chat/data/`

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

Medium

Hidden file access · 2 occurrences

数据: ~/.claude/skills/ai-partner-chat/data/

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Critical

install.sh:12 install.sh:94 install.sh:99 install.sh:1 README.md:192 README.md:196 README.md:198 scripts/code_parser.py:31 scripts/code_parser.py:32 scripts/code_parser.py:109-111 scripts/conversation_logger.py:194 scripts/example_usage.py:32-38 scripts/orchestrator.py:199-214 scripts/orchestrator.py:214-217 scripts/orchestrator.py:217-223 scripts/orchestrator.py:223-382 scripts/orchestrator.py:382-384 scripts/tag_generator.py:206-208 SKILL.md:14-21 SKILL.md:21-25 SKILL.md:25-31 SKILL.md:31-42 SKILL.md:42-51 SKILL.md:51-54 SKILL.md:54-60 SKILL.md:60-63 SKILL.md:63-69 SKILL.md:69-81 SKILL.md:81-85 SKILL.md:85-88 SKILL.md:88-89 SKILL.md:89-123 SKILL.md:123-134 SKILL.md:134-138 SKILL.md:138-139 SKILL.md:139-143 SKILL.md:143-144 SKILL.md:144-147 SKILL.md:147-149 SKILL.md:149 SKILL.md:152-154 SKILL.md:154-162 SKILL.md:162 SKILL.md:165-174 SKILL.md:174-177 SKILL.md:177-186 SKILL.md:186-190 SKILL.md:190-192 SKILL.md:192-193 SKILL.md:193-196 SKILL.md:196-197 SKILL.md:197-199 SKILL.md:199-207 SKILL.md:207-241 SKILL.md:241-250 SKILL.md:250-264 SKILL.md:264-267 SKILL.md:267-268 SKILL.md:268-270 SKILL.md:270-273 SKILL.md:273-279 SKILL.md:279-286 SKILL.md:286-290 SKILL.md:290-293 SKILL.md:293-296 SKILL.md:296-299 SKILL.md:299-303 SKILL.md:303-306 SKILL.md:306-308 SKILL.md:308-311 SKILL.md:311-318 SKILL.md:318-323 SKILL.md:323-329 SKILL.md:329-332 SKILL.md:332-339 SKILL.md:339-342 SKILL.md:342-352 SKILL.md:352-355 SKILL.md:355-360 SKILL.md:360-368 SKILL.md:368-382 SKILL.md:382-385 SKILL.md:385-394 SKILL.md:394-398 SKILL.md:398-415 SKILL.md:415-419 SKILL.md:419-421 SKILL.md:421-425 SKILL.md:425-427 SKILL.md:427-436 SKILL.md:436-446 SKILL.md:446-464 SKILL.md:464-477 SKILL.md:477-518 SKILL.md:518-525 SKILL.md:525-526 SKILL.md:526-527 SKILL.md:527-528 SKILL.md:528-551 SKILL.md:551-560 SKILL.md:560-578 SKILL.md:578-579 SKILL.md:579-580 SKILL.md:580-581 SKILL.md:581-582 SKILL.md:582-585 SKILL.md:585-596 SKILL.md:596-616 SKILL.md:616-622 SKILL.md:622-628 SKILL.md:628-662 SKILL.md:662-668 SKILL.md:668-688 SKILL.md:688-692 SKILL.md:692-756 SKILL.md:756-760 SKILL.md:760-811 SKILL.md:811-814 SKILL.md:814-821 SKILL.md:821-839 SKILL.md:839-842 SKILL.md:842-870 SKILL.md:870-877 SKILL.md:877-879 SKILL.md:879-887 SKILL.md:887-894 SKILL.md:894-899 SKILL.md:899-915 SKILL.md:915-916 SKILL.md:916-922 SKILL.md:922-927 SKILL.md:927-940 SKILL.md:940-978 SKILL.md:978-979 SKILL.md:979-983 SKILL.md:983-986 SKILL.md:986-989 SKILL.md:989-1003 SKILL.md:1003-1004 SKILL.md:1004-1009 SKILL.md:1009-1021 SKILL.md:1021-1022 SKILL.md:1022-1023 SKILL.md:1023-1024 SKILL.md:1024-1031 SKILL.md:1031-1035 SKILL.md:1035-1038 SKILL.md:1038-1041 SKILL.md:1041-1053 SKILL.md:1053-1067 SKILL.md:1067-1071 SKILL.md:1071-1074 SKILL.md:1074-1091 SKILL.md:1091-1098 SKILL.md:1098-1104 SKILL.md:1104-1107 SKILL.md:1107-1111 SKILL.md:1111-1116 SKILL.md:1116-1122 SKILL.md:1122-1125 SKILL.md:1125-1129 SKILL.md:1129-1138 SKILL.md:1138-1148 SKILL.md:1148-1150 SKILL.md:1150 SKILL.md:1154-1159 SKILL.md:1159-1169 SKILL.md:1169-1178 SKILL.md:1178-1184 SKILL.md:1184-1187 SKILL.md:1187-1195 SKILL.md:1195-1198 SKILL.md:1198-1206 SKILL.md:1206-1212 SKILL.md:1212-1241 SKILL.md:1241-1283 SKILL.md:1283-1295 SKILL.md:177 SKILL.md:1115 SKILL.md:1116

Recursive delete on root/home

rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db

Force-confirmed blocker/critical static finding; AI dismissal overridden.

Risk Factors

⚙️ External commands (180)

📁 Filesystem access (86)

install.sh:13 install.sh:33 install.sh:34 install.sh:35 install.sh:36 install.sh:37 install.sh:38 install.sh:39 install.sh:40 install.sh:43 install.sh:44 install.sh:45 install.sh:46 install.sh:94 install.sh:99 install.sh:15 README.md:61 README.md:78 README.md:90 README.md:97 README.md:98 README.md:117 README.md:126 README.md:384 README.md:404 README.md:61 README.md:78 README.md:90 README.md:97 README.md:98 README.md:117 README.md:126 README.md:384 README.md:404 README.md:363 scripts/conversation_logger.py:62 scripts/conversation_logger.py:207 scripts/conversation_logger.py:347 scripts/emotion_analyzer.py:42 scripts/note_processor.py:49 scripts/orchestrator.py:44 scripts/orchestrator.py:85 scripts/orchestrator.py:44 scripts/orchestrator.py:85 scripts/tag_generator.py:61 scripts/tag_indexer.py:51 scripts/thinking_analyzer.py:149 scripts/vector_indexer.py:42 scripts/vector_indexer.py:83 scripts/vector_indexer.py:42 scripts/vector_indexer.py:43 scripts/vector_indexer.py:83 SKILL.md:63 SKILL.md:89 SKILL.md:133 SKILL.md:138 SKILL.md:162 SKILL.md:170 SKILL.md:173 SKILL.md:208 SKILL.md:327 SKILL.md:336 SKILL.md:820 SKILL.md:1034 SKILL.md:1063 SKILL.md:1100 SKILL.md:1109 SKILL.md:1141 SKILL.md:1142 SKILL.md:63 SKILL.md:89 SKILL.md:133 SKILL.md:138 SKILL.md:162 SKILL.md:170 SKILL.md:173 SKILL.md:208 SKILL.md:327 SKILL.md:336 SKILL.md:820 SKILL.md:1034 SKILL.md:1063 SKILL.md:1100 SKILL.md:1109 SKILL.md:1141 SKILL.md:1142

🌐 Network access (1)

scripts/emotion_analyzer.py:17-20 scripts/orchestrator.py:29-32

⚡ Contains scripts (2)

🔑 Env variables (2)

scripts/vector_indexer.py:53 scripts/vector_indexer.py:54

Audited by: codex

Audit version 7

Jul 6, 2026, 09:38 AM

Files scanned

5,345

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (17)

High

scripts/vector_indexer.py:92-95

Remote Model Code Execution Enabled

The vector indexer loads the embedding model with trust_remote_code=True. When a remote model is downloaded, custom model code can execute during model loading.

The code directly passes trust_remote_code=True to SentenceTransformer for the configured model name. This is a recognized remote-code execution risk for model loading.

High

SKILL.md:23-31 SKILL.md:83-89 README.md:26-30

Default Persistent Conversation Logging

The cited instructions explicitly require recording every conversation and describe automatic conversation history storage. The code path in conversation_logger.py supports that behavior.

Medium

SQLite database file

│ ├── chroma.sqlite3 # 所有向量存储

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

self.db_path = db_path

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

indexer = VectorIndexer(db_path=self.db_path)

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

self.db_path = db_path

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

print(f"💾 Connecting to vector database at: {self.db_path}")

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

self.client = chromadb.PersistentClient(path=self.db_path)

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

print(f" Database location: {os.path.abspath(self.db_path)}")

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

'database_path': os.path.abspath(self.db_path)

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

'database_path': os.path.abspath(self.db_path)

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

self.db_path = db_path

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

self.client = chromadb.PersistentClient(path=self.db_path)

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

f"Failed to connect to database at {self.db_path}. "

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

SQLite database file

│ └── chroma.sqlite3 # ⚡ 所有笔记/对话/代码的向量都在这里

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

assets/ai-persona-template.md:33-37

SQLite database file

│ └── chroma.sqlite3

The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.

Medium

Opaque Use of Stored Personal Context

The AI persona template tells the assistant to introduce user information like its own memories and not mention that it came from records. This weakens transparency around stored personal data use.

The cited template text directly asks the assistant to avoid saying that recalled user information came from records. This is a clear transparency and consent concern rather than a scanner pattern.

Capability review items (29)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

Hidden file in home directory

3. ✅ 记录每次对话到 `~/.claude/skills/ai-partner-chat/data/`

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

High

Hidden file in home directory

~/.claude/skills/ai-partner-chat/data/

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

High

Hidden file in home directory

rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

High

Hidden file in home directory

skill_dir: skill 目录路径(默认 ~/.claude/skills/ai-partner-chat)

The orchestrator defaults runtime data to ~/.claude/skills/ai-partner-chat/data. This hidden home-directory storage contains long-term note and conversation memory.

High

Hidden file in home directory

print(f" 数据: ~/.claude/skills/ai-partner-chat/data/")

The orchestrator defaults runtime data to ~/.claude/skills/ai-partner-chat/data. This hidden home-directory storage contains long-term note and conversation memory.

High

Hidden file in home directory

- 💾 状态持久化到 `~/.claude/skills/ai-partner-chat/data/indexes/processed_notes.json`

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

High

Hidden file in home directory

- ✅ 所有数据保存到 `~/.claude/skills/ai-partner-chat/data/`

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

High

Hidden file in home directory · 2 occurrences

数据: ~/.claude/skills/ai-partner-chat/data/

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

Medium

Unix shell invocation

#!/bin/bash

The skill ships a Bash installer that copies files and removes old skill subdirectories under ~/.claude. This creates a real external command surface even though execution is explicit.

Medium

install.sh:13

Hidden file access

TARGET_DIR="$HOME/.claude/skills/ai-partner-chat"

Medium

install.sh:15

Temp directory access

BACKUP_DIR="/tmp/ai-partner-data-backup-$$"

The installer backs up existing skill data into /tmp using a predictable path. That can expose personal memory data to local temp-directory risks during installation.

Medium

Hidden file access

3. ✅ 记录每次对话到 `~/.claude/skills/ai-partner-chat/data/`

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

Medium

Hidden file access

~/.claude/skills/ai-partner-chat/data/

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

Medium

Hidden file access

rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

Medium

README.md:363

Temp directory access

备份位置: /tmp/ai-partner-data-backup-$$

The installer backs up existing skill data into /tmp using a predictable path. That can expose personal memory data to local temp-directory risks during installation.

Medium

Python file write/append

with open(self.metadata_file, 'w', encoding='utf-8') as f:

This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.

Medium

Python file write/append

with open(daily_file, 'a', encoding='utf-8') as f:

This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.

Medium

Python file write/append

with open(summary_file, 'w', encoding='utf-8') as f:

This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.

Medium

Python file write/append

with open(self.timeline_path, 'w', encoding='utf-8') as f:

This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.

Medium

Python file write/append

with open(self.state_file, 'w', encoding='utf-8') as f:

This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.

Medium

Hidden file access

skill_dir: skill 目录路径(默认 ~/.claude/skills/ai-partner-chat)

The orchestrator defaults runtime data to ~/.claude/skills/ai-partner-chat/data. This hidden home-directory storage contains long-term note and conversation memory.

Medium

Hidden file access

print(f" 数据: ~/.claude/skills/ai-partner-chat/data/")

The orchestrator defaults runtime data to ~/.claude/skills/ai-partner-chat/data. This hidden home-directory storage contains long-term note and conversation memory.

Medium

Python file write/append

with open(self.index_path, 'w', encoding='utf-8') as f:

This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.

Medium

Python file write/append

with open(report_file, 'w', encoding='utf-8') as f:

This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.

Medium

Hidden file access

- 💾 状态持久化到 `~/.claude/skills/ai-partner-chat/data/indexes/processed_notes.json`

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

Medium

Hidden file access

- ✅ 所有数据保存到 `~/.claude/skills/ai-partner-chat/data/`

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

Medium

Hidden file access · 2 occurrences

数据: ~/.claude/skills/ai-partner-chat/data/

The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.

Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Critical

Recursive delete on root/home

rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db

Force-confirmed blocker/critical static finding; AI dismissal overridden.

Risk Factors

⚙️ External commands (180)

📁 Filesystem access (86)

🌐 Network access (1)

scripts/emotion_analyzer.py:17-20 scripts/orchestrator.py:29-32

⚡ Contains scripts (2)

🔑 Env variables (2)

scripts/vector_indexer.py:53 scripts/vector_indexer.py:54

Audited by: codex

Audit version 6

Jun 29, 2026, 09:51 AM

Static analysis reported many command, filesystem, network, and obfuscation signals. Most shell/backtick and weak-crypto hits are documentation or regex false positives, and no prompt injection attempt was found. The skill still presents high risk because it loads a model with trust_remote_code=True and is designed to persist user conversations and project notes by default.

Files scanned

5,345

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (5)

High

scripts/vector_indexer.py:92-95 scripts/vector_indexer.py:85-90

Remote Model Code Execution Enabled

The vector indexer loads BAAI/bge-m3 with trust_remote_code=True. If the model source changes or is compromised, model loading can execute untrusted code in the user environment.

The code explicitly enables trust_remote_code while loading an external embedding model. This is a known supply-chain execution risk, even if the intended model is legitimate.

Medium

SKILL.md:23-31 SKILL.md:83-89 scripts/conversation_logger.py:121-159 scripts/conversation_logger.py:206-239

Default Conversation Logging and Vectorization

The skill instructions tell Claude to record every conversation, and the logger writes user and AI messages to Markdown files and vector storage when importance is medium or higher.

The behavior is directly documented in the skill instructions and implemented in the logger. It is local storage, but it can retain sensitive conversation content by default.

Medium

SKILL.md:38-63 scripts/note_processor.py:65-90 scripts/orchestrator.py:90-183

Project Notes Are Scanned and Persisted

The note processor scans Markdown files under the project notes directory, reads their contents, and sends them to the orchestrator for tagging, analysis, and vector indexing.

The scanner behavior and persistence path are explicit in both the skill instructions and implementation. This is legitimate functionality but needs user consent and privacy warnings.

Medium

install.sh:13-15 install.sh:30-46 install.sh:52-68

Installer Modifies Hidden Claude Skill Directory

The installer writes into ~/.claude/skills/ai-partner-chat and removes selected old subdirectories before copying new files. The deletion is scoped, but it still changes hidden application data.

The installer uses a fixed target under the user home directory and scoped rm commands. This is not malicious, but marketplace users should understand the filesystem changes.

Low

README.md:400-405

Documented Destructive Troubleshooting Command

The README documents rm -rf for rebuilding the local vector database. It is a manual troubleshooting command and targets only the skill vector database path.

The command is visible in documentation and is scoped to the skill database. It can delete user memory data but is not executed automatically.

Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

README.md:49-58 SKILL.md:123-134 SKILL.md:177-186 SKILL.md:1115-1121

Static Command Alerts Are Mostly Markdown Examples

Many shell, Python, and PowerShell alerts occur inside README and SKILL usage examples. They are not hidden runtime execution paths, but users may copy and run them.

The cited locations are fenced documentation snippets. They are relevant user guidance, but they are not automatic command execution by the skill.

Low

config/tags_taxonomy.json:28 config/tags_taxonomy.json:41 scripts/vector_utils.py:232 scripts/vector_utils.py:357

Weak Cryptography Alerts Are False Positives

The weak-crypto hits correspond to taxonomy words and prose such as design-patterns, system-design, and query descriptions, not cryptographic primitives.

The inspected lines contain tag names or ordinary prose. No hashing, encryption, or weak cryptographic algorithm usage is present there.

Risk Factors

⚡ Contains scripts (4)

scripts/vector_indexer.py:92-95 scripts/conversation_logger.py:121-159 scripts/note_processor.py:79-99 scripts/orchestrator.py:186-285

🌐 Network access (3)

scripts/vector_indexer.py:85-95 README.md:87-90 SKILL.md:136-140

📁 Filesystem access (6)

install.sh:13-46 scripts/conversation_logger.py:40-63 scripts/conversation_logger.py:206-239 scripts/note_processor.py:33-49 scripts/note_processor.py:65-90 scripts/orchestrator.py:49-59

🔑 Env variables (1)

scripts/vector_indexer.py:51-56

⚙️ External commands (5)

install.sh:1-15 install.sh:91-99 SKILL.md:123-134 SKILL.md:177-186 README.md:395-405

Detected Patterns

trust_remote_code=True During Model LoadPersistent Storage of User ConversationsRecursive Removal in Installer

Audited by: codex

Audit version 5

Jan 17, 2026, 12:32 AM

After detailed analysis, this is a legitimate AI learning companion skill. All static findings are false positives: backticks are documentation examples, cryptographic patterns are benign tech lists, hidden file access is standard Claude Code skill storage, and SQLite/ChromaDB operations are intended local persistence. No malicious intent or credential exfiltration detected.

Files scanned

5,716

Lines analyzed

Review items

False positives ignored

Risk Factors

📁 Filesystem access (3)

scripts/conversation_logger.py:62 scripts/note_processor.py:49 scripts/vector_indexer.py:104

⚡ Contains scripts (2)

scripts/emotion_analyzer.py:17 scripts/orchestrator.py:29

Audited by: claude

Audit version 4

Jan 17, 2026, 12:32 AM

Files scanned

5,716

Lines analyzed

Review items

False positives ignored

Risk Factors

📁 Filesystem access (3)

scripts/conversation_logger.py:62 scripts/note_processor.py:49 scripts/vector_indexer.py:104

⚡ Contains scripts (2)

scripts/emotion_analyzer.py:17 scripts/orchestrator.py:29

Audited by: claude

Audit version 3

Jan 10, 2026, 01:08 PM

Legitimate AI learning assistant skill with local data storage. All data stays on user's machine via ChromaDB. Network access only for downloading embedding model from HuggingFace.

Files scanned

3,580

Lines analyzed

Review items

False positives ignored

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low

scripts/note_processor.py:59-77

Filesystem access to user notes directory

The skill scans project 'notes/' directory to process markdown files. This is expected behavior for a note processing skill. Access is limited to notes directory within projects where the skill is activated.

Low

scripts/note_processor.py:59-77 scripts/orchestrator.py:54-59

Model download from HuggingFace

The BAAI/bge-m3 embedding model (~4.3GB) is downloaded from HuggingFace on first run. This is documented and necessary for vector embeddings. Model cached locally for subsequent runs.

Risk Factors

📁 Filesystem access (2)

🌐 Network access (1)

scripts/note_processor.py:59-77

⚡ Contains scripts (1)

install.sh:1-130

Audited by: claude

Audit version 2

Jan 10, 2026, 01:08 PM

Legitimate AI learning assistant skill with local data storage. All data stays on user's machine via ChromaDB. Network access only for downloading embedding model from HuggingFace.

Files scanned

3,580

Lines analyzed

Review items

False positives ignored

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low

Filesystem access to user notes directory

Low

scripts/note_processor.py:59-77 scripts/orchestrator.py:54-59

Model download from HuggingFace

The BAAI/bge-m3 embedding model (~4.3GB) is downloaded from HuggingFace on first run. This is documented and necessary for vector embeddings. Model cached locally for subsequent runs.

Risk Factors

📁 Filesystem access (2)

🌐 Network access (1)

scripts/note_processor.py:59-77

⚡ Contains scripts (1)

install.sh:1-130

Audited by: claude

Audit version 1

Jan 10, 2026, 01:08 PM

Legitimate AI learning assistant skill with local data storage. All data stays on user's machine via ChromaDB. Network access only for downloading embedding model from HuggingFace.

Files scanned

3,580

Lines analyzed

Review items

False positives ignored

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low

Filesystem access to user notes directory

Low

scripts/note_processor.py:59-77 scripts/orchestrator.py:54-59

Model download from HuggingFace

The BAAI/bge-m3 embedding model (~4.3GB) is downloaded from HuggingFace on first run. This is documented and necessary for vector embeddings. Model cached locally for subsequent runs.

Risk Factors

📁 Filesystem access (2)

🌐 Network access (1)