Security audit
Security checks for vulnerabilities and agentic risk
The skill is not clearly malicious, but it asks agents to log and backfill broad personal activity history with weak scoping and unsafe temporary-file handling.
Install only if you intentionally want a local memory system that records actions and can import email, calendar, and message history. Before use, narrow when the causal skill runs, avoid bulk backfill unless explicitly needed, review or patch the fixed /tmp export paths, and define retention/deletion rules for memory/causal and memory/ontology data.
skills/causal-md/scripts/backfill_email.py:167Predictable Temporary File Exposes Email History and Permits Symlink-Based File Overwrite
skills/causal-md/scripts/backfill_calendar.py:173Predictable Temporary File Exposes Calendar History and Permits Symlink-Based File Overwrite
skills/causal-md/scripts/backfill_messages.py:161Predictable Temporary File Retains Full Messaging Export and Permits Symlink-Based File Overwrite
This variant asserts the reverse mismatch—ontology present but causal capability absent—and the markdown does not provide enough proof of meaningful causal inference beyond a named estimation script. While not an exploit by itself, inaccurate capability claims are still a security-relevant trust issue, particularly when the skill stores user data and may influence decisions.
This variant asserts the reverse mismatch—ontology present but causal capability absent—and the markdown does not provide enough proof of meaningful causal inference beyond a named estimation script. While not an exploit by itself, inaccurate capability claims are still a security-relevant trust issue, particularly when the skill stores user data and may influence decisions.
This variant asserts the reverse mismatch—ontology present but causal capability absent—and the markdown does not provide enough proof of meaningful causal inference beyond a named estimation script. While not an exploit by itself, inaccurate capability claims are still a security-relevant trust issue, particularly when the skill stores user data and may influence decisions.
This variant asserts the reverse mismatch—ontology present but causal capability absent—and the markdown does not provide enough proof of meaningful causal inference beyond a named estimation script. While not an exploit by itself, inaccurate capability claims are still a security-relevant trust issue, particularly when the skill stores user data and may influence decisions.
This variant asserts the reverse mismatch—ontology present but causal capability absent—and the markdown does not provide enough proof of meaningful causal inference beyond a named estimation script. While not an exploit by itself, inaccurate capability claims are still a security-relevant trust issue, particularly when the skill stores user data and may influence decisions.
This variant asserts the reverse mismatch—ontology present but causal capability absent—and the markdown does not provide enough proof of meaningful causal inference beyond a named estimation script. While not an exploit by itself, inaccurate capability claims are still a security-relevant trust issue, particularly when the skill stores user data and may influence decisions.
This variant asserts the reverse mismatch—ontology present but causal capability absent—and the markdown does not provide enough proof of meaningful causal inference beyond a named estimation script. While not an exploit by itself, inaccurate capability claims are still a security-relevant trust issue, particularly when the skill stores user data and may influence decisions.
Referenced artifact was not completely inspected
python3 skills/ontology-md/scripts/ontology.py create --type Person --props '{"name":"Alice"}'
Referenced artifact was not completely inspected
python3 skills/ontology-md/scripts/ontology.py create --type Person --props '{"name":"Alice"}'
Referenced artifact was not completely inspected
python3 skills/ontology-md/scripts/ontology.py create --type Person --props '{"name":"Alice"}'
Referenced artifact was not completely inspected
python3 skills/ontology-md/scripts/ontology.py create --type Person --props '{"name":"Alice"}'
The trigger metadata says to activate on 'ANY high-level action with observable outcomes,' which is extremely broad and likely to invoke the skill on routine user activity. Overbroad triggering can silently expand logging, analysis, and decision influence into many contexts the user did not intend, increasing privacy and operational risk.
The trigger section explicitly covers unrestricted 'ANY high-level action' across communications, calendar, tasks, files, social, purchases, and system changes. This lack of scope boundaries makes accidental invocation and collection of unrelated activity highly likely, especially in environments where the agent can observe or execute many actions.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
forbidden_properties: [password, secret, token, key, api_key] properties: service: string secret_ref: string # Reference to secret store (e.g., "keychain:github-token") expires: datetime? scope: string[]?
The skill advertises shell execution and file-writing behavior through its documented commands, but it does not declare any tool scope such as allowed-tools or permissions. That creates an authorization and review gap: users and orchestrators cannot easily tell that the skill can execute local commands and persist data, increasing the chance of unintended command execution or data modification.
Trigger phrases such as '记住', 'what do I know', or 'show dependencies' are broad, natural-language expressions that can arise in ordinary conversation. In a skill that writes persistent knowledge and action history, overly generic triggers increase the risk of accidental activation, unintended storage of sensitive data, and unauthorized modifications to local memory.
The skill explicitly stores entities, credentials, devices, messages, notes, and action history in persistent local files, but the markdown provides no warning about sensitivity, retention, access control, or consent. This is dangerous because users may unknowingly persist secrets, personal data, or communication metadata to disk where it can later be exposed, reused, or mishandled.
The skill is framed as causal reasoning support, but it expands into broad collection and reconstruction of historical user activity across email, calendar, messaging, files, and purchases. That creates a capability mismatch: a reasoning layer does not inherently require indiscriminate cross-domain data harvesting, and the broad data access materially increases privacy and abuse risk.
The backfill section instructs use of external tools to export sent emails, calendar events, and message history into temporary files for later processing. This can expose sensitive communications metadata and content without clear necessity, consent boundaries, minimization, or handling safeguards, making overcollection and data leakage more likely.
The backfill guidance directs extraction and parsing of historical communications and calendar data without any user-facing privacy warning, consent flow, or disclosure of what will be stored. Historical communications are often sensitive, and bulk retrospective access creates substantial confidentiality and compliance risk.
The required action log stores structured records of user actions, context, pre-state, post-state, and outcomes in persistent local memory, but the skill does not warn that this may contain sensitive behavioral or communication data. Persistent telemetry without notice, minimization, or retention controls can create privacy exposure and forensic value for attackers.
Although presented as a reasoning aid, the workflow gives the skill authority to influence or control execution-time decisions, including ranking actions, executing the 'best' action, and refusing or escalating based on its own thresholds. That increases the blast radius from advisory analysis to operational autonomy, which can cause unintended actions or denials if the model is wrong or manipulated.
Suspicious Unicode normalization or mixed-script content
The script persistently backfills user calendar history into an action log under memory/causal/action_log.jsonl, which materially expands the skill from ontology/causal inference into collection and retention of behavioral history. That creates a privacy and data-minimization risk because sensitive scheduling metadata is stored long-term without clear consent, retention limits, or scope justification.
The script writes derived calendar metadata such as meeting times, attendee counts, recurrence, and video presence into a persistent local action log without any warning that this data may be sensitive. Even if full event contents are not stored, this behavioral log can reveal patterns about work, relationships, and routines if accessed by other tools or users on the system.