Cognitive Agent

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:57 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed cognitive-memory agent, but it asks agents to retain user history, emotions, and arbitrary logs without clear privacy controls.

Install only if you are comfortable with a skill that may build long-term local memory about users, preferences, interaction history, and emotions. Before using it with real users or sensitive conversations, add explicit opt-in, inspect/export/delete controls, retention limits, and redaction for logs and memories; also pin dependencies and verify the missing runtime implementation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (13)

Hidden Instructions

High

• Category: Prompt Injection

Content

---
name: cognitive-agent
description: 基于认知天性理论的类人 AI 生命体框架，让 AI 具备人类学习、记忆、成长的特性
metadata:

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README documents persistent memory storage on disk and emotion/user-input processing, but provides no privacy notice, consent guidance, retention limits, or safeguards for sensitive data. In a skill centered on storing memories and interpreting user emotions, this omission can lead operators to deploy it in ways that collect, retain, or infer sensitive personal information without appropriate handling controls.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly promotes remembering user preferences and history, but it does not define consent, retention limits, deletion behavior, or categories of data that must not be stored. In a memory-centric agent, this creates a realistic risk of unnecessary long-term collection of personal or sensitive information through normal use.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill encourages broad remembering of user history and preferences without any minimization boundary, purpose limitation, or exclusion of sensitive categories. In a conversational AI setting, that can lead to silent profiling and retention of personal details users may reveal incidentally over time.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The logging example writes error details and arbitrary context directly to local markdown files, creating persistent storage of potentially sensitive prompts, user data, tokens, or operational details. Because there is no warning, minimization, redaction, or access-control guidance, adopters may persist confidential material unintentionally.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The learning-log design persists arbitrary context details in plain text, which can capture sensitive user-provided content far beyond what is necessary for troubleshooting or learning. Because this skill is explicitly designed to accumulate memory and learning artifacts, the surrounding context makes over-collection and long-lived retention more likely and therefore more dangerous.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The natural-language instructions and API guidance are presented only in Chinese, which effectively forces a specific language for users without opt-in or an explicit locale justification. Per the policy, language constraints should either be optional or clearly documented as region-specific.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: Nearly all user-facing descriptive content is in Chinese, and the file does not indicate that the skill is region-specific or offer users a language/locale option. Under SQP-3, forcing a specific language without opt-in can be a natural-language policy violation when no justification is documented.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: This manifest contains a user-facing description only in Chinese, which imposes a specific language choice without indicating opt-in, alternatives, or a documented region-specific constraint. Under the policy, language or locale restrictions should either be optional for users or clearly justified.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"metacognition"
  ],
  "dependencies": {
    "lancedb": "^0.4.0",
    "uuid": "^9.0.0"
  },
  "devDependencies": {

• Confidence: 90% confidence
• Finding: Using a caret range for lancedb allows installation of newer compatible releases without explicit review, which increases supply-chain risk if a future release introduces a vulnerability or malicious code. In this package.json, the dependency is not pinned and there is no evidence of compensating controls such as a lockfile policy or integrity verification.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

],
  "dependencies": {
    "lancedb": "^0.4.0",
    "uuid": "^9.0.0"
  },
  "devDependencies": {
    "jest": "^29.0.0"

• Confidence: 94% confidence
• Finding: The uuid dependency is specified with a caret range, so consumers may resolve to different releases over time, including ones that may contain known or newly introduced flaws. This is more concerning here because a separate finding notes an advisory affecting some uuid versions, and the unpinned range makes it unclear whether deployments are exposed.

Unverifiable Dependency: uuid has 1 known advisory(ies) (CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The manifest references uuid without pinning a specific version, while there is a known advisory for some uuid releases. Because the resolved installed version is not fixed here, it is impossible to verify from this file alone whether affected code may be installed, creating an avoidable supply-chain and vulnerability-management gap.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"uuid": "^9.0.0"
  },
  "devDependencies": {
    "jest": "^29.0.0"
  },
  "scripts": {
    "test": "jest",

• Confidence: 82% confidence
• Finding: An unpinned devDependency like jest can introduce supply-chain risk during development or CI by allowing unexpected package updates to be installed. Although the direct runtime impact is lower than a production dependency, compromised test tooling can still affect build pipelines, secrets, or published artifacts.

Static analysis

No suspicious patterns detected.