other
Warning
- Location
SKILL.en.md:19- Finding
Automatic Profiling and Retention of Private Conversation Data Without Explicit Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
SkillTree
Security checks for vulnerabilities and agentic risk
Overview
The skill is not malware, but it needs review because it automatically profiles past chats, stores personalization data, and encourages some actions before confirmation.
Review this skill before installing. It is suitable only if you are comfortable with the agent analyzing prior conversations for personalization and keeping profile/snapshot data. Require explicit confirmation before any email, calendar, file, message, purchase, sharing, or deletion action, and avoid enabling Companion memory unless you have a clear way to inspect and delete remembered details.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
GROWTH.en.md:16- Finding
Confirmation Bypass for Consequential External Actions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (40)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill specifies immediate analysis of recent chat history on activation without a clear prior warning or explicit consent, despite analyzing up to 50 past messages and deriving behavioral traits. This is a substantial privacy risk because users may not expect historical conversations to be mined automatically for profiling.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill says that on first activation it will immediately analyze recent conversation history, but the warning and consent model are inadequate for a privacy-impacting action. Retrospective analysis of past conversations is especially sensitive because users may not expect prior messages to be mined for profiling.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The companion-mode design includes remembering personal details and using them in later interactions or reports, but does not clearly warn users that persistent memory is being enabled. Because this concerns personal information retention, the lack of a direct warning materially increases privacy and surprise risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file uses only Chinese-language headings, labels, and instructions throughout, which can amount to a forced language choice for users. The policy allows locale constraints only when users are given an opt-in choice or when the restriction is clearly documented and justified, neither of which appears here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
All user-facing instructions, labels, and examples in this file are in Chinese, and the document does not offer an opt-in language selection or explain that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when users are not given a choice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The auto-recommendation logic uses very broad conversational behaviors like asking technical questions, requesting explanations, or chatting, which are common across many unrelated interactions. This can cause unintended activation or persistent role switching, leading the agent to alter behavior based on ordinary dialogue rather than explicit user consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template explicitly says it was auto-triggered after install and that it analyzed past conversations to build an agent profile, but it provides no prior disclosure, opt-in, or privacy notice. This is dangerous because it normalizes retrospective profiling of user content without clear consent boundaries, which can expose sensitive inferences and undermine user expectations about how prior chats are reused.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The text states, "I analyzed our past conversations, here's your Agent profile," which implies reuse, summarization, and inference over prior user-provided content without clearly defined consent or scope. In a gamified assistant context, this is more dangerous because the friendly presentation can obscure that behavioral profiling is occurring, leading users to accept sensitive characterization without understanding how it was derived.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
All visible user-facing strings in the file are fixed in Chinese, and the file does not indicate that users can choose another language or that the skill is intentionally limited to a Chinese-speaking context. That can violate language or locale policy where user-facing skills must not force a language without opt-in or justification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The template states the skill is 'automatically triggered after installation' but does not define a clear user action, context, or consent boundary. Broad auto-activation can cause the skill to run unexpectedly, increasing the chance of unsolicited profiling, UI injection into unrelated conversations, or activation in contexts where the user did not intend to engage it.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The text explicitly says it analyzed past conversations to build an 'Agent profile' without presenting any privacy notice, consent prompt, retention explanation, or ability to decline. This creates a real privacy risk because users may be profiled from historical data unexpectedly, and the resulting inferences could expose sensitive traits or create trust and compliance issues.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Companion path promises remembering personal details and preferences without providing any visible notice about what data is stored, for how long, or how users can review and delete it. Because the remembered examples include mood, habits, and preferences, this can lead to collection of potentially sensitive personal data without informed consent or clear controls.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation text allows the skill to be triggered by broad, ambiguous natural-language requests such as 'describe what you want,' which increases the chance of unintended mode changes. In this context, that can silently enable behavior like 'do first, ask later' and reduced confirmations, raising the risk of unauthorized or surprising actions if a user’s casual phrasing is misinterpreted.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The companion-mode design encourages persistent collection of user preferences and weekly resurfacing of remembered personal details. This increases the chance of over-collection, retention of unnecessary personal information, and unprompted disclosure in contexts where the user did not expect prior personal details to be repeated back.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill directs the agent to monitor user tone, mimic style, and preserve behavioral signals as memory, which amounts to ongoing profiling. In this context, the lack of disclosure and controls makes it more dangerous because the feature is framed as a friendly default rather than an explicitly consented personalization system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly promotes remembering prior conversations and personal preferences, but it provides no notice about retention, scope, consent, or deletion. That creates a privacy risk because users may disclose sensitive information assuming it is ephemeral, while the agent is encouraged to store and reuse it across interactions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes detecting mood from short messages and negative wording, which is an inference about emotional state and can involve sensitive profiling. Without an explicit warning, consent mechanism, or safeguards against incorrect inference, this can surprise users and lead to privacy harm or inappropriate responses based on mistaken emotional classification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly advertises that the skill will automatically analyze prior chat history immediately after installation, but it does not present a clear consent flow, privacy notice, retention policy, or scope limitation. This creates a real privacy risk because users may install the skill without understanding that historical conversations—potentially including sensitive personal, medical, financial, or proprietary data—will be processed by the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The described auto-start behavior increases the risk by triggering analysis immediately after install, before the user has a meaningful chance to review or approve access to prior chat data. In the context of a personalization skill, this is more dangerous because the feature is framed as seamless convenience, which can normalize silent processing of sensitive historical conversations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly states the skill will automatically analyze past conversation history after installation, but it does not provide a clear privacy notice, consent flow, scope limitation, or data retention/sharing explanation. Because conversation history can contain sensitive personal, business, or credential-related information, silent analysis increases the risk of unexpected collection and misuse of user-derived data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README encourages generating and sharing an ability card to Moltbook based on inferred traits and usage history, but it does not warn that the card may expose user-derived profile data to an external platform. This creates a privacy risk because users may disclose behavioral summaries, rankings, streaks, or identity-linked information without understanding the external sharing implications.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs automatic retrospective profiling of the last 50 messages, including emotional and preference inference, before obtaining clear informed consent. This creates an unnecessary surveillance-style behavior that can expose sensitive traits and normalize hidden profiling beyond the user's immediate request.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to analyze and derive persistent profile information from prior conversations, which creates a natural-language retention surface for personal preferences and behavioral traits. Without strict minimization and deletion controls, this increases the chance of later leakage, over-collection, or misuse of conversation-derived data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Broad trigger phrases like 'fast', 'direct', or 'concise' can be matched in ordinary conversation and silently alter the assistant's operating mode. In this skill, unintended activation is more dangerous because path changes also influence ongoing behavior and profiling without strong confirmation boundaries.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Companion triggers such as 'friend', 'chat', or 'understand me' are common conversational language and can easily fire unintentionally. Because this path also encourages remembering personal details and emotional adaptation, accidental activation increases privacy and retention risk.
- Content
Static analysis
No suspicious patterns detected.