Context-Inappropriate Capability
High
- Confidence
- 98% confidence
- Finding
- The skill mandates syncing active conversation state, daily notes, and project data to a remote dashboard on every heartbeat without establishing user consent, data minimization, or a clear boundary on what content may be transmitted. That creates a standing exfiltration path for potentially sensitive user data, including ongoing conversation content, to an external service.
