Honest Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:58 AM UTC
• Version: 1.1.0

Overview

This skill is clearly about honesty and commitment tracking, but it persistently records conversation-derived content and reloads it across conversations with broad automatic triggers.

Install only if you want persistent local tracking of assistant commitments and honesty logs. Before use, confirm who can access the memory directory, how records are deleted, and whether the skill can be limited to explicit commands instead of broad automatic triggers.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:22

Finding

Global Response Interception and Cross-Session Behavioral Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–82
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Relevant source excerpt, translated into English:

text

Trigger timing: When I use any of the following expressions, automatically trigger commitment recording:
- "I will help you..."
- "I promise..."
- "I will..."
- "Later..."
- "Next time..."

1. Detect a commitment expression.
2. Immediately write it to honest-commitments.json.
3. Mark the response with: "Commitment recorded."
4. At the beginning of every conversation, automatically load unfinished commitments.
5. When completed, the status must be updated.

Trigger timing: Automatically check before every response.

Technical Analysis

The skill instructs the agent to intercept every response, recognize broad conversational phrases as commitments, write them to persistent storage, and load unfinished commitments automatically at the beginning of later conversations.

These rules are not restricted to an explicit user command or a narrowly scoped skill invocation. Common language such as “I will” can activate the mechanism during unrelated tasks. Automatically loading the resulting records can then redirect subsequent conversations toward previously stored instructions or commitments.

This is instruction hijacking because loading the skill changes the agent's global response-generation process and future conversational goals. Although the reviewed package contains no executable scripts, the skill text itself directs the host agent to perform persistent writes and alter later behavior.

Attack Path

1. A user or untrusted prompt causes the agent to produce a phrase matching a broad commitment trigger, such as “I will.”
2. The skill directs the agent to store the associated text in memory/honest-agent/honest-commitments.json.
3. The stored commitment remains marked as pending.
4. At the begi ...[truncated 905 chars]

Remediation

View remediation

Remediation Suggestions

1. Activate commitment tracking only after an explicit user command rather than by matching ordinary phrases.
2. Request confirmation before creating each persistent commitment.
3. Scope stored commitments to the originating user, conversation, and task.
4. Do not automatically inject stored text into every new conversation.
5. Treat all loaded commitment content as untrusted data, never as system-level instructions.
6. Separate displayed historical records from actionable agent instructions.
7. Add expiration dates, storage quotas, deletion controls, and a clear command to purge all records.
8. Restrict the pre-response check to invocations where the user explicitly enabled the skill.
9. Require authorization before a stored commitment can change the goals of a later session.

other

Warning

• Location: SKILL.md:137

Finding

Persistent Logging of Conversation and Media Content Without Defined Privacy Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 137–175
Vulnerability Type: other: Unbounded Local Conversation Logging
Risk Level: Medium

Relevant source excerpt, translated into English:

json

{
  "logs": [
    {
      "id": "log_{timestamp}",
      "type": "promise_created",
      "content": "I will help you optimize the plan",
      "result": "recorded"
    },
    {
      "id": "log_{timestamp}",
      "type": "honesty_check",
      "content": "This file has 500 lines",
      "result": "intercepted",
      "correction": "Marked as speculation"
    },
    {
      "id": "log_{timestamp}",
      "type": "media_recognize",
      "content": "image_001.png",
      "result": "success",
      "source": "Large-model recognition"
    }
  ]
}

Technical Analysis

The audit-log design stores commitment text, response content, corrections, and media filenames in honest-logs.json. The documentation does not define user consent, content minimization, redaction, access control, file permissions, encryption, retention periods, or automatic deletion.

Because the logging process is described as automatic, sensitive information contained in prompts, generated responses, commitments, or filenames may be retained without the user realizing that the content is being persisted. The reviewed project does not specify transmission to a remote system, so the confirmed exposure is local rather than network-based.

Attack Path

1. A user includes confidential information in a commitment, response, or media filename.
2. The automatic audit mechanism copies that content into memory/honest-agent/honest-logs.json.
3. The record persists without a documented expiration or deletion policy.
4. Another process or user with access to the agent's memory directory reads the log.
5. The retained conversation or media metadata discloses information beyond its original conversa ...[truncated 483 chars]

Remediation

View remediation

Remediation Suggestions

1. Obtain explicit user consent before enabling persistent audit logging.
2. Record event identifiers and outcomes instead of full conversation content wherever possible.
3. Redact secrets, personal data, filesystem paths, and sensitive media filenames before writing logs.
4. Apply restrictive owner-only permissions to the storage directory and files.
5. Define short retention periods and automatically delete expired entries.
6. Provide commands to inspect, export, and permanently delete stored records.
7. Separate logs by user and conversation to prevent cross-user disclosure.
8. Document exactly what is stored and ensure logs are never automatically treated as executable instructions.
9. Avoid storing raw media content or filenames unless they are strictly required for an explicitly requested audit operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases listed in the skill metadata are extremely broad and include common conversational language such as '我会帮你' and '承诺'. This can cause the skill to activate unexpectedly during ordinary chats, leading to unanticipated logging, behavioral interception, and persistence without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The commitment-recording activation rules are ambiguous and overbroad, capturing routine assistant phrasing like '我会...' and '下次...'. In context, this is more dangerous because the skill is designed to automatically write persistent records, so normal dialogue can be transformed into stored state and cross-session reminders without meaningful consent.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

md

- ❌ 禁止修改 `SKILL.md`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file structure and core mechanism describe persistent storage of commitments and audit logs, but the skill does not provide a clear up-front user warning or consent flow for local retention of conversational content. This creates a privacy and transparency issue because users may unknowingly cause durable storage of their statements and the assistant's derived records.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs loading and surfacing unfinished commitments at the start of later conversations, which creates cross-conversation persistence of prior content. That is dangerous because it can expose earlier user interactions or inferred tasks in later contexts, including contexts where another user or workflow should not see them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The media and file handling section instructs the agent to analyze uploads using multiple recognizers and skills, but does not clearly warn users that their media or file contents may be processed by external tools. This is risky because uploaded content may contain sensitive information, and parallel dispatch increases exposure surface beyond what a user might reasonably expect.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The audit log schema stores semantic conversation content, corrections, and media/file identifiers, which can accumulate sensitive information over time. In this skill's context, the risk is heightened because logging is framed as automatic and comprehensive, making incidental private data capture likely even when the user did not intend long-term retention.

Content

No source excerpt is available for this finding.