T01 · Skill Instruction Hijacking
Error
- Location
scripts/install.py:12- Finding
Persistent modification of the agent workspace instruction file
- Content
View full analysis
- Remediation
View remediation
Security audit
Super Brain
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed local memory system, but it persistently changes startup instructions and stores/shares broad personal conversation data with weak consent and privacy controls.
Install only if you intentionally want a persistent, local, cross-session memory layer that can profile conversations, moods, preferences, projects, reminders, and agent activity. Review and disable the TOOLS.md startup injection, make storage opt-in, avoid saving raw conversations or secrets, require redaction before any write, keep subagents from mounting the full database, and add a real delete/export/encryption story before using this with sensitive or shared-machine data.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (7)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/vector_memory.py:163- Finding
Raw conversation content is persisted without consent or sensitive-data filtering
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ethics_engine.py:17- Finding
Sensitive-data filter detects matches but fails to redact them
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/schema.sql:221- Finding
Behavioral and mood profiling is enabled by default while encryption is disabled
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:580- Finding
Complete persistent memory database is shared with spawned subagents
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/data_manager.py:38- Finding
Maintenance operations delete and inspect data outside the selected user scope
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/data_manager.py:137- Finding
Retention cleanup creates unencrypted archives that preserve expired conversation data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (53)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The design explicitly stores persistent user profile data, conversation insights, projects, reminders, and semantic conversation memory across sessions, but does not describe any user notice, consent flow, retention limit, or access control. This creates a real privacy and surveillance risk because sensitive personal data can be accumulated invisibly and later exposed, misused, or retained beyond user expectations.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The schema centralizes rich personal and conversational data, including profile information, goals, moods, projects, reminders, and vectorized semantic memory, creating a broad data exposure surface. If accessed improperly or reused inappropriately, this dataset could reveal highly sensitive personal patterns far beyond a single conversation.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The schema includes inferred sensitive attributes such as mood, energy level, preferences, behavior patterns, and relationship stage, all of which go beyond necessary task memory and can enable profiling. Collecting and inferring these attributes without transparent disclosure or explicit consent is dangerous because users may not realize they are being psychologically modeled across sessions.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The memory module directs automatic extraction and storage of key facts, mood, and preferences after each dialogue turn, making sensitive profiling continuous and implicit. This is especially dangerous because the capture is automatic and frequent, increasing the chance of collecting inaccurate, intimate, or unnecessary inferences without user awareness.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill instructs installation of persistent session-start behavior and implies modification of local workspace guidance/state while claiming to be a memory feature. Persistently altering startup behavior is more dangerous than ordinary memory because it can silently shape all future sessions and normalize undeclared data access before user interaction.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill instructs installation of persistent session-start behavior and implies modification of local workspace guidance/state while claiming to be a memory feature. Persistently altering startup behavior is more dangerous than ordinary memory because it can silently shape all future sessions and normalize undeclared data access before user interaction.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill instructs installation of persistent session-start behavior and implies modification of local workspace guidance/state while claiming to be a memory feature. Persistently altering startup behavior is more dangerous than ordinary memory because it can silently shape all future sessions and normalize undeclared data access before user interaction.
- Content
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Taken as a whole, the skill establishes a pattern of persistent collection, inference, reminder generation, and eventual sharing of user context with subagents. This progressive expansion is dangerous because it normalizes surveillance-like behavior under the benign framing of 'memory' and increases the blast radius of any mistake or misuse.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill normalizes automatic cross-session retention and summarization of user content as mandatory setup behavior. Because it is positioned as something that must run after installation, it pressures silent persistence before users have meaningful notice or per-conversation consent.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill mandates loading stored user profile, projects, and effective patterns before processing any user message. This broad default reuse of previously collected personal data increases privacy risk and can influence responses using stale or sensitive context the user did not intend to surface in the current conversation.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The auto-trigger conditions are extremely broad, including common phrases like 'previously' or 'continue', and can activate memory behaviors without a clear user request. In context, this is especially risky because activation leads to loading historical profile and project data before handling the current message.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs automatic extraction and storage of key facts, mood, preferences, and effectiveness signals from every turn without requiring clear upfront consent. This creates persistent profiling and behavioral inference from ordinary conversation, which is highly sensitive in a personalization system.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The post-turn workflow stores extracted facts, mood, preferences, and self-evaluated effectiveness after every interaction. In context, this is a strong profiling mechanism that accumulates sensitive behavioral metadata over time and goes beyond simple memory recall.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documented subagent spawning behavior is not justified by the stated purpose of long-term memory and personalization, yet it expands the attack surface by creating additional execution contexts with access to shared user data. Cross-agent sharing of a brain database can expose sensitive profiles, history, and inferred preferences to more components than necessary.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The schema contains self-evolution, skill versioning, knowledge-gap tracking, performance metrics, and improvement queues, which enable the system to analyze itself and potentially modify behavior over time beyond simple user memory. In an agent skill, undisclosed self-modification and capability growth are dangerous because they can bypass expected review boundaries, persist risky behavior, and expand collection and decision-making without clear user consent.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section describes generating session summaries, inserting conversation insights, learning response patterns, updating user profiles, and creating follow-up reminders at session end, all of which constitute long-term behavioral profiling. That is especially risky because the skill is designed for 'self-enhancement' and proactive personalization, making undisclosed retention and downstream reuse of conversation content more invasive and more likely to affect future interactions in ways the user did not knowingly authorize.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file claims sensitive information will not be stored or propagated, but the engine later logs arbitrary user-linked context, reasoning, and ethical check data to a persistent SQLite database. In a long-memory skill, this mismatch is dangerous because users and downstream components may rely on the privacy rule while sensitive content is still retained, creating a real confidentiality and compliance risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
All natural-language instructions, examples, labels, and interaction text in the file are Chinese, and the document does not state that language selection is optional or user-controlled. This can amount to a language/locale policy issue when a skill effectively forces one language without offering a choice.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The design goal is to make the AI remember service experience across sessions and continually reuse prior conversational details, which inherently creates persistent natural-language retention risk. Even without explicit exfiltration behavior, accumulated summaries and preferences can leak sensitive context in future responses or through compromise of stored memory.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The proactive reminder and prediction features allow the system to initiate follow-up actions based on prior conversations, yet the design does not tell users this behavior will occur or give them control over it. This is risky because unsolicited inference-driven outreach can feel manipulative, reveal retained context unexpectedly, and expose sensitive project or behavioral details at the wrong time.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documents file, environment, and database access behaviors but does not declare any explicit tool scope or allowed-tools boundaries. This increases the chance that an agent will exercise broader capabilities than users expect, especially because the skill also instructs automatic startup and post-conversation processing.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest frames the skill as memory/personalization, but the body also introduces multi-agent orchestration and shared execution. This broadens the trust boundary substantially because user context is no longer just stored locally; it becomes input to a larger execution framework than the description suggests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The description and all operational examples are written as a Chinese-only skill experience, and the title/behavior imply a fixed locale without any opt-in or alternative language handling. Under the policy, forcing a specific language without user choice is a natural-language policy concern.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The end-of-session workflow creates summaries, inferred next steps, and follow-up reminders for future use. While useful, these are still derived personal data artifacts that can reveal ongoing projects, intentions, and unresolved issues across sessions without explicit approval.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 74% confidence
- Finding
The agent task tables introduce persistence of task and collaboration state across sessions. In this skill's context, that persistence is not inherently malicious, but it does preserve operational traces and potentially links user tasks to agent activity over time, expanding the amount of retained metadata.
- Content
sql -- 代理任务表 CREATE TABLE IF NOT EXISTS agent_tasks ( id TEXT PRIMARY KEY, main_task_id TEXT, -- 主任务ID subtask_id TEXT, -- 子任务ID
Static analysis
No suspicious patterns detected.