Versioned security assessment
Report ID: SA-94ADA0BF
7/6/2026, 9:38:05 AM
ai-partner-chat security assessment v8
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- ai-partner-chat
- Version
- v8
- Maintainer
- Cz07cring
- Coverage
- 21 Files scanned · 5,345 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
17 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most static command detections are false positives from Markdown code fences, documentation, normal imports, and safe local cache paths. Confirmed risks include persistent storage of conversations, notes, tags, emotion data, and vector data under hidden home directories, plus temporary backup of skill data during installation. Semantic review also found remote model loading with trusted code enabled, default conversation logging, and opaque reuse of stored personal context.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
21 Files scanned · 5,345 Lines analyzed
46 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 2 evidence locations
Network access
May connect to external services.
Observed in 1 evidence location
Filesystem access
May read or write local files.
Observed in 56 evidence locations
Env variables
May read values from the process environment.
Observed in 2 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 180 evidence locations
Capability review items (29)
High
Hidden file in home directory
3. ✅ 记录每次对话到 `~/.claude/skills/ai-partner-chat/data/`
The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.
High
Hidden file in home directory
~/.claude/skills/ai-partner-chat/data/
The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.
High
Hidden file in home directory
rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db
The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.
High
Hidden file in home directory
skill_dir: skill 目录路径(默认 ~/.claude/skills/ai-partner-chat)
The orchestrator defaults runtime data to ~/.claude/skills/ai-partner-chat/data. This hidden home-directory storage contains long-term note and conversation memory.
High
Hidden file in home directory
print(f" 数据: ~/.claude/skills/ai-partner-chat/data/")
The orchestrator defaults runtime data to ~/.claude/skills/ai-partner-chat/data. This hidden home-directory storage contains long-term note and conversation memory.
High
Hidden file in home directory
- 💾 状态持久化到 `~/.claude/skills/ai-partner-chat/data/indexes/processed_notes.json`
The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.
High
Hidden file in home directory
- ✅ 所有数据保存到 `~/.claude/skills/ai-partner-chat/data/`
The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.
High
Hidden file in home directory
数据: ~/.claude/skills/ai-partner-chat/data/
The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.
High
Hidden file in home directory
数据: ~/.claude/skills/ai-partner-chat/data/
The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.
Medium
Unix shell invocation
#!/bin/bash
The skill ships a Bash installer that copies files and removes old skill subdirectories under ~/.claude. This creates a real external command surface even though execution is explicit.
Medium
Hidden file access
TARGET_DIR="$HOME/.claude/skills/ai-partner-chat"
The installer targets ~/.claude/skills/ai-partner-chat and modifies a hidden home-directory skill location. That is expected for installation but security-sensitive for marketplace auto-install policy.
Medium
Temp directory access
BACKUP_DIR="/tmp/ai-partner-data-backup-$$"
The installer backs up existing skill data into /tmp using a predictable path. That can expose personal memory data to local temp-directory risks during installation.
Medium
Hidden file access
3. ✅ 记录每次对话到 `~/.claude/skills/ai-partner-chat/data/`
The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.
Medium
Hidden file access
~/.claude/skills/ai-partner-chat/data/
The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.
Medium
Hidden file access
rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db
The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.
Medium
Temp directory access
备份位置: /tmp/ai-partner-data-backup-$$
The installer backs up existing skill data into /tmp using a predictable path. That can expose personal memory data to local temp-directory risks during installation.
Medium
Python file write/append
with open(self.metadata_file, 'w', encoding='utf-8') as f:
This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.
Medium
Python file write/append
with open(daily_file, 'a', encoding='utf-8') as f:
This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.
Medium
Python file write/append
with open(summary_file, 'w', encoding='utf-8') as f:
This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.
Medium
Python file write/append
with open(self.timeline_path, 'w', encoding='utf-8') as f:
This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.
Medium
Python file write/append
with open(self.state_file, 'w', encoding='utf-8') as f:
This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.
Medium
Hidden file access
skill_dir: skill 目录路径(默认 ~/.claude/skills/ai-partner-chat)
The orchestrator defaults runtime data to ~/.claude/skills/ai-partner-chat/data. This hidden home-directory storage contains long-term note and conversation memory.
Medium
Hidden file access
print(f" 数据: ~/.claude/skills/ai-partner-chat/data/")
The orchestrator defaults runtime data to ~/.claude/skills/ai-partner-chat/data. This hidden home-directory storage contains long-term note and conversation memory.
Medium
Python file write/append
with open(self.index_path, 'w', encoding='utf-8') as f:
This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.
Medium
Python file write/append
with open(report_file, 'w', encoding='utf-8') as f:
This is an actual file write of conversation, note, tag, emotion, or report metadata. The behavior is intended, but it persists personal context and should be consented and managed.
Medium
Hidden file access
- 💾 状态持久化到 `~/.claude/skills/ai-partner-chat/data/indexes/processed_notes.json`
The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.
Medium
Hidden file access
- ✅ 所有数据保存到 `~/.claude/skills/ai-partner-chat/data/`
The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.
Medium
Hidden file access
数据: ~/.claude/skills/ai-partner-chat/data/
The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.
Medium
Hidden file access
数据: ~/.claude/skills/ai-partner-chat/data/
The referenced path is the hidden home-directory location where this skill stores long-term personal memory data. That storage model is intentional but privacy-sensitive.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (17)
RISK-001 High
Remote Model Code Execution Enabled
The vector indexer loads the embedding model with trust_remote_code=True. When a remote model is downloaded, custom model code can execute during model loading.
The code directly passes trust_remote_code=True to SentenceTransformer for the configured model name. This is a recognized remote-code execution risk for model loading.
RISK-002 High
Default Persistent Conversation Logging
The skill instructs Claude to record each conversation and store all data in the hidden skill data directory unless the user explicitly opts out. This can retain sensitive prompts, replies, notes, and code by default.
The cited instructions explicitly require recording every conversation and describe automatic conversation history storage. The code path in conversation_logger.py supports that behavior.
RISK-003 Medium
SQLite database file
│ ├── chroma.sqlite3 # 所有向量存储
The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.
RISK-004 Medium
SQLite database file
self.db_path = db_path
The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.
RISK-005 Medium
SQLite database file
indexer = VectorIndexer(db_path=self.db_path)
The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.
RISK-006 Medium
SQLite database file
self.db_path = db_path
The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.
RISK-007 Medium
SQLite database file
print(f"💾 Connecting to vector database at: {self.db_path}")
The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.
RISK-008 Medium
SQLite database file
self.client = chromadb.PersistentClient(path=self.db_path)
The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.
RISK-009 Medium
SQLite database file
print(f" Database location: {os.path.abspath(self.db_path)}")
The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.
RISK-010 Medium
SQLite database file
'database_path': os.path.abspath(self.db_path)
The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.
RISK-011 Medium
SQLite database file
'database_path': os.path.abspath(self.db_path)
The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.
RISK-012 Medium
SQLite database file
self.db_path = db_path
The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.
RISK-013 Medium
SQLite database file
self.client = chromadb.PersistentClient(path=self.db_path)
The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.
RISK-014 Medium
SQLite database file
f"Failed to connect to database at {self.db_path}. "
The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.
RISK-015 Medium
SQLite database file
│ └── chroma.sqlite3 # ⚡ 所有笔记/对话/代码的向量都在这里
The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.
RISK-016 Medium
SQLite database file
│ └── chroma.sqlite3
The skill stores notes, conversations, and code embeddings in a persistent ChromaDB SQLite-backed vector database. This is security-sensitive because it can contain personal or proprietary content.
RISK-017 Medium
Opaque Use of Stored Personal Context
The AI persona template tells the assistant to introduce user information like its own memories and not mention that it came from records. This weakens transparency around stored personal data use.
The cited template text directly asks the assistant to avoid saying that recalled user information came from records. This is a clear transparency and consent concern rather than a scanner pattern.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighRemote model code execution is enabled during embedding model loading.Remove trust_remote_code=True, pin a reviewed model revision, and document the model source and download behavior.
- FIX-002HighConversation logging is enabled as the default workflow.Make logging opt-in, show a clear consent prompt, and provide an easy per-session disable command.
- FIX-003MediumPersonal notes, conversations, tags, and emotion timelines are retained in hidden local storage.Add retention controls, deletion commands, encryption guidance, and a clear data inventory in the README and SKILL.md.
- FIX-004MediumThe installer backs up user memory data into /tmp.Use mktemp with restrictive permissions or keep backups inside the skill data directory with explicit user confirmation.
- FIX-005MediumThe persona template discourages transparent disclosure when answers use stored records.Remove that guidance and require clear language when a reply uses stored notes or conversation history.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Static false positives ignored (1)
Critical
Recursive delete on root/home
rm -rf ~/.claude/skills/ai-partner-chat/data/vector_db
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable