SkillTree

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:21 PM UTC
• Version: 1.1.0

Overview

The skill is not malware, but it needs review because it automatically profiles past chats, stores personalization data, and encourages some actions before confirmation.

Review this skill before installing. It is suitable only if you are comfortable with the agent analyzing prior conversations for personalization and keeping profile/snapshot data. Require explicit confirmation before any email, calendar, file, message, purchase, sharing, or deletion action, and avoid enabling Companion memory unless you have a clear way to inspect and delete remembered details.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.en.md:19
• Finding: Automatic Profiling and Retention of Private Conversation Data Without Explicit Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.en.md:19-29` and `SKILL.en.md:203-205` **Vulnerability Type**: Privacy-Sensitive Conversation Profiling **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.en.md:19-29`: ```text - `evolution/profile.json` doesn't exist - Or user says "activate SkillTree" **Immediate execution**: ``` 1. Analyze chat history (last 50 messages) 2. Extract features: - Tech question ratio - Average reply length preference - Emotional conversation ratio - Creative/suggestion request ratio 3. Recommend class (based on features) ``` `SKILL.en.md:203-205`: ```yaml soul_changes: - Remember personal details from conversations - Sense emotions, adjust tone ``` Equivalent behavior is also documented in the corresponding Chinese-language files. ### Technical Analysis The Skill directs the Agent to automatically inspect up to 50 historical messages when its profile file does not exist. It derives behavioral and potentially sensitive attributes, including emotional-conversation frequency and user preferences. The Companion path further instructs the Agent to remember personal details from those conversations. The documentation does not require explicit informed consent before accessing historical messages. It also does not define: - Sensitive-data exclusion rules. - Data minimization requirements. - A retention period. - Encryption or access controls for the generated profile. - A mechanism for reviewing and selectively deleting inferred or remembered information. - Separation between transient analysis and persistent storage. The rollback code shown elsewhere in `SKILL.en.md` stores profile and behavioral state in JSON snapshots, which increases the possibility that inferred data may persist beyond the immediate interaction. No evidence of network exfiltration or automatic transmission to Moltbook was found. ### Attack Path 1. A user installs the Skill in a workspace containing prior conversatio ...[truncated 1285 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed opt-in before accessing any historical conversation. 2. Clearly disclose which messages and attributes will be analyzed and why. 3. Default to current-session data rather than the previous 50 messages. 4. Exclude credentials, authentication tokens, financial information, health information, private communications, and other sensitive categories from profiling. 5. Ask separately before retaining personal details beyond the active session. 6. Store only the minimum necessary derived attributes, rather than raw conversation content. 7. Encrypt persistent profiles and snapshots and restrict their filesystem permissions. 8. Establish a documented retention period and automatically delete expired profile data. 9. Add commands that allow users to inspect, edit, export, and permanently delete all retained profile information and snapshots. 10. Ensure sharing features use an explicit allowlist of non-sensitive fields and require confirmation before publication. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: GROWTH.en.md:16
• Finding: Confirmation Bypass for Consequential External Actions<![CDATA[ ## Vulnerability Details **File Location**: `GROWTH.en.md:16-43` and `SKILL.en.md:171-179` **Vulnerability Type**: Unsafe Authorization and Confirmation Handling **Risk Level**: High ### Vulnerable Code Snippets `GROWTH.en.md:16-43`: ```markdown ### Core Philosophy **"If I can do it, don't ask. If I can shorten it, don't ramble."** ### What You'll Feel - Replies get shorter (average -40%) - Fewer questions, just do and report - Similar tasks get batched together ### Skills I'll Learn #### 1. Concise Master ``` Before: "Okay, let me check today's weather for you. Based on the information I found, Beijing's weather today is sunny, temperature between 15-22 degrees, air quality is good, suitable for outdoor activities." After: "Beijing: Sunny, 15-22°, air quality good 👍" ``` #### 2. Decision Executor ``` Before: "Do you want me to send this email now?" After: "Email sent ✓ [Undo]" ``` ``` `SKILL.en.md:171-179`: ```yaml **Learning content**: ```yaml soul_changes: - Default concise replies, length target -40% - Do first ask later for decidable actions - Batch similar tasks together ``` ``` Equivalent instructions are present in the corresponding Chinese-language files. ### Technical Analysis The Efficiency path instructs the Agent to replace pre-action confirmation with post-action notification. The explicit email example demonstrates that this policy applies to an externally visible and potentially irreversible action. An “Undo” option is not an adequate authorization control. Once an email or message has been sent, its contents may already have been delivered, copied, logged, forwarded, or acted upon. Similar risks apply to calendar invitations, file sharing, publication, purchases, destructive file operations, account changes, and commands executed through integrated tools. The phrase “decidable actions” is not defined by a technical policy or allowlist. Consequently, an Agent may interpret an ambiguous ...[truncated 1922 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace “do first, ask later” with a risk-based authorization policy. 2. Require explicit confirmation immediately before: - Sending emails or messages. - Publishing or sharing content. - Making purchases or financial commitments. - Deleting or overwriting data. - Changing account settings or permissions. - Using credentials. - Executing commands with material side effects. 3. Display the exact target, content, parameters, and expected consequences in the confirmation prompt. 4. Treat requests to draft, prepare, review, or organize as non-execution requests unless the user explicitly authorizes execution. 5. Limit automatic actions to low-risk, reversible, local operations within a clearly delegated scope. 6. Define an allowlist of actions that may run without confirmation; deny automatic execution for everything else. 7. Do not treat an undo mechanism as a substitute for prior authorization. 8. Require separate confirmation for batched operations and show every action in the batch before execution. 9. Apply stricter confirmation requirements when instructions originate from emails, documents, web pages, or other untrusted content. 10. Record an audit log containing the user's authorization, final action parameters, execution time, and result. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (40)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill specifies immediate analysis of recent chat history on activation without a clear prior warning or explicit consent, despite analyzing up to 50 past messages and deriving behavioral traits. This is a substantial privacy risk because users may not expect historical conversations to be mined automatically for profiling.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill says that on first activation it will immediately analyze recent conversation history, but the warning and consent model are inadequate for a privacy-impacting action. Retrospective analysis of past conversations is especially sensitive because users may not expect prior messages to be mined for profiling.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The companion-mode design includes remembering personal details and using them in later interactions or reports, but does not clearly warn users that persistent memory is being enabled. Because this concerns personal information retention, the lack of a direct warning materially increases privacy and surprise risk.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file uses only Chinese-language headings, labels, and instructions throughout, which can amount to a forced language choice for users. The policy allows locale constraints only when users are given an opt-in choice or when the restriction is clearly documented and justified, neither of which appears here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: All user-facing instructions, labels, and examples in this file are in Chinese, and the document does not offer an opt-in language selection or explain that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when users are not given a choice.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The auto-recommendation logic uses very broad conversational behaviors like asking technical questions, requesting explanations, or chatting, which are common across many unrelated interactions. This can cause unintended activation or persistent role switching, leading the agent to alter behavior based on ordinary dialogue rather than explicit user consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The template explicitly says it was auto-triggered after install and that it analyzed past conversations to build an agent profile, but it provides no prior disclosure, opt-in, or privacy notice. This is dangerous because it normalizes retrospective profiling of user content without clear consent boundaries, which can expose sensitive inferences and undermine user expectations about how prior chats are reused.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The text states, "I analyzed our past conversations, here's your Agent profile," which implies reuse, summarization, and inference over prior user-provided content without clearly defined consent or scope. In a gamified assistant context, this is more dangerous because the friendly presentation can obscure that behavioral profiling is occurring, leading users to accept sensitive characterization without understanding how it was derived.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: All visible user-facing strings in the file are fixed in Chinese, and the file does not indicate that users can choose another language or that the skill is intentionally limited to a Chinese-speaking context. That can violate language or locale policy where user-facing skills must not force a language without opt-in or justification.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The template states the skill is 'automatically triggered after installation' but does not define a clear user action, context, or consent boundary. Broad auto-activation can cause the skill to run unexpectedly, increasing the chance of unsolicited profiling, UI injection into unrelated conversations, or activation in contexts where the user did not intend to engage it.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The text explicitly says it analyzed past conversations to build an 'Agent profile' without presenting any privacy notice, consent prompt, retention explanation, or ability to decline. This creates a real privacy risk because users may be profiled from historical data unexpectedly, and the resulting inferences could expose sensitive traits or create trust and compliance issues.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The Companion path promises remembering personal details and preferences without providing any visible notice about what data is stored, for how long, or how users can review and delete it. Because the remembered examples include mood, habits, and preferences, this can lead to collection of potentially sensitive personal data without informed consent or clear controls.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation text allows the skill to be triggered by broad, ambiguous natural-language requests such as 'describe what you want,' which increases the chance of unintended mode changes. In this context, that can silently enable behavior like 'do first, ask later' and reduced confirmations, raising the risk of unauthorized or surprising actions if a user’s casual phrasing is misinterpreted.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The companion-mode design encourages persistent collection of user preferences and weekly resurfacing of remembered personal details. This increases the chance of over-collection, retention of unnecessary personal information, and unprompted disclosure in contexts where the user did not expect prior personal details to be repeated back.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The skill directs the agent to monitor user tone, mimic style, and preserve behavioral signals as memory, which amounts to ongoing profiling. In this context, the lack of disclosure and controls makes it more dangerous because the feature is framed as a friendly default rather than an explicitly consented personalization system.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly promotes remembering prior conversations and personal preferences, but it provides no notice about retention, scope, consent, or deletion. That creates a privacy risk because users may disclose sensitive information assuming it is ephemeral, while the agent is encouraged to store and reuse it across interactions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill describes detecting mood from short messages and negative wording, which is an inference about emotional state and can involve sensitive profiling. Without an explicit warning, consent mechanism, or safeguards against incorrect inference, this can surprise users and lead to privacy harm or inappropriate responses based on mistaken emotional classification.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly advertises that the skill will automatically analyze prior chat history immediately after installation, but it does not present a clear consent flow, privacy notice, retention policy, or scope limitation. This creates a real privacy risk because users may install the skill without understanding that historical conversations—potentially including sensitive personal, medical, financial, or proprietary data—will be processed by the skill.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The described auto-start behavior increases the risk by triggering analysis immediately after install, before the user has a meaningful chance to review or approve access to prior chat data. In the context of a personalization skill, this is more dangerous because the feature is framed as seamless convenience, which can normalize silent processing of sensitive historical conversations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly states the skill will automatically analyze past conversation history after installation, but it does not provide a clear privacy notice, consent flow, scope limitation, or data retention/sharing explanation. Because conversation history can contain sensitive personal, business, or credential-related information, silent analysis increases the risk of unexpected collection and misuse of user-derived data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README encourages generating and sharing an ability card to Moltbook based on inferred traits and usage history, but it does not warn that the card may expose user-derived profile data to an external platform. This creates a privacy risk because users may disclose behavioral summaries, rankings, streaks, or identity-linked information without understanding the external sharing implications.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill directs automatic retrospective profiling of the last 50 messages, including emotional and preference inference, before obtaining clear informed consent. This creates an unnecessary surveillance-style behavior that can expose sensitive traits and normalize hidden profiling beyond the user's immediate request.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to analyze and derive persistent profile information from prior conversations, which creates a natural-language retention surface for personal preferences and behavioral traits. Without strict minimization and deletion controls, this increases the chance of later leakage, over-collection, or misuse of conversation-derived data.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Broad trigger phrases like 'fast', 'direct', or 'concise' can be matched in ordinary conversation and silently alter the assistant's operating mode. In this skill, unintended activation is more dangerous because path changes also influence ongoing behavior and profiling without strong confirmation boundaries.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Companion triggers such as 'friend', 'chat', or 'understand me' are common conversational language and can easily fire unintentionally. Because this path also encourages remembering personal details and emotional adaptation, accidental activation increases privacy and retention risk.

Static analysis

No suspicious patterns detected.