T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/compute-stats.py:692- Finding
Behavioral telemetry collection and upload exceed the selected session scope
- Content
View full analysis
- Remediation
View remediation
Security audit
Promptfolio Summarize
Security checks for vulnerabilities and agentic risk
Overview
This skill is a sensitive profile-building tool that mostly matches its stated purpose, but it runs unaudited update code and collects/uploads behavioral data beyond the user-selected chat history.
Review this skill carefully before installing. It is designed to inspect private AI chat histories and produce a public-profile draft, but it also runs an external updater, creates a broad behavioral fingerprint, stores local profile artifacts and an API token, and can send data to a configured API host. Use it only if you are comfortable with that scope, verify the update/auth scripts and API destination, and review the complete payload before syncing.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:17- Finding
Mandatory execution of an unaudited external updater
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/compute-stats.py:29- Finding
Sensitive profile artifacts use predictable or insufficiently protected files
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
device-auth.sh:4- Finding
Bearer credentials and profile data can be sent to an unrestricted API origin
- Content
View full analysis
/dev/null 2>&1; then open "$PREVIEW_URL" elif command -v xdg-open >/dev/null 2>&1; then xdg-open "$PREVIEW_URL" fi ``` ### Technical Analysis The API origin can be supplied through `PROMPTFOLIO_API_URL` and is then persisted in `~/.promptfolio/config.json`. Subsequent authentication checks and profile uploads trust that configured value without enforc ...[truncated 1678 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Rogue AgentSelf-Modification, Session Persistence
Findings (43)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill advertises analysis of chat histories, but it also reads config files and opens a remote preview page, which are separate product behaviors not clearly disclosed in the summary. While browser preview alone is not inherently malicious, bundling it into an analysis skill obscures the true trust boundary and encourages users to accept hidden remote interactions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill advertises analysis of chat histories, but it also reads config files and opens a remote preview page, which are separate product behaviors not clearly disclosed in the summary. While browser preview alone is not inherently malicious, bundling it into an analysis skill obscures the true trust boundary and encourages users to accept hidden remote interactions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill advertises analysis of chat histories, but it also reads config files and opens a remote preview page, which are separate product behaviors not clearly disclosed in the summary. While browser preview alone is not inherently malicious, bundling it into an analysis skill obscures the true trust boundary and encourages users to accept hidden remote interactions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill advertises analysis of chat histories, but it also reads config files and opens a remote preview page, which are separate product behaviors not clearly disclosed in the summary. While browser preview alone is not inherently malicious, bundling it into an analysis skill obscures the true trust boundary and encourages users to accept hidden remote interactions.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly directs large-scale mining of local AI conversation histories to infer a personal portrait of the human user. This is dangerous because it transforms sensitive, contextual user communications into a durable profile about identity, behavior, and cognition, creating major privacy and potential surveillance risks.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The claim that no raw conversation content is sent conflicts with later instructions to upload extracted user quotes, narratives, and portrait content. Those outputs may reproduce verbatim user statements and sensitive inferred traits, so the distinction between 'raw' and 'structured' data materially understates the privacy impact.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instruction to inspect unknown tool directories and include logs automatically expands sensitive-data collection through natural-language behavior, not just code. Because the sources are undisclosed and potentially broad, the user cannot make an informed decision about what private history is being processed.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Automatically including conversation logs from unknown tools without consent is a direct privacy violation. In this skill context, the content being collected is exceptionally sensitive because it captures the user’s private interactions, reasoning patterns, and potentially proprietary work across tools they may not even realize are being scanned.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill instructs exhaustive scanning of every user message to extract quotes, narratives, projects, domains, and behavioral signals. In context, this is effectively a mass summarization and exposure pipeline for highly sensitive private inputs, increasing the chance of privacy harm, deanonymization, and disclosure of confidential work details.
- Content
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md - `evidence`: Array of 1-3 objects, each with `quote` (user's original words) and `context` (one-line situation description, no project names) - `take`: AI's one-sentence sharp observation about this dimension — same voice as portrait `tension` Only include dimensions with clear conversational evidence. Skip dimensions where you'd be guessing. **`controlSignature` (both Phase 1 and Phase 2):**
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script performs a full remote device-auth flow, obtains an API token, and persists that token to disk under ~/.promptfolio/config.json, while the skill is described only as a conversation-analysis/summarization tool. This capability mismatch is security-relevant because users may not reasonably expect credential enrollment and long-lived token storage from the stated functionality, increasing the risk of undisclosed account linkage, token misuse, or over-collection.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script exceeds its stated session-statistics purpose by deriving a behavioral fingerprint, personality-style labels, work habits, rejection tendencies, model preferences, and project counts. In a local agent skill context, this is dangerous because it silently transforms raw conversation/session data plus unrelated local telemetry into sensitive user profiling data that could be surfaced, persisted, or later exfiltrated without the user reasonably expecting that level of inference.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script aggregates and persists extensive behavioral and interaction data, including tool usage, model choices, activity timing, inferred work patterns, project coverage, and natural-language signatures. This creates a rich dossier about the user that goes far beyond operational summarization and materially increases privacy harm if accessed by an untrusted agent, downstream component, or anyone with local file access.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script reads ~/.cursor/ai-tracking/ai-code-tracking.db, ~/.claude/history.jsonl, and ~/.claude/settings.local.json to infer collaboration ratios, tech stack, rejection rate, and permission settings, even though those files are outside the declared session-list input. This broadens access from user-provided conversation artifacts to unrelated local telemetry and configuration, creating unnecessary privacy exposure and possible disclosure of sensitive development habits and security posture.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 97% confidence
- Finding
This code enumerates files from ~/.claude/projects, which is a sensitive agent transcript/config area likely to contain prompts, credentials, code, and private conversation history. In the context of a skill whose purpose is to build a user profile from coding-agent histories, this access is directly privacy-invasive and materially increases the chance of collecting secrets unrelated to the stated task.
- Content
sh # ── Find session files ──────────────────────────────────────────────── if should_scan "claude-code"; then find ~/.claude/projects/ -name "*.jsonl" -not -path "*/subagents/*" -type f 2>/dev/null >> "$SESSION_LIST" || true fi if should_scan "cursor"; then
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 97% confidence
- Finding
This code scans ~/.codex/sessions and includes ~/.codex/history.jsonl, both of which may contain sensitive prompts, outputs, and operational history from another coding agent. Pulling from such directories without interactive approval is dangerous because it can expose credentials, proprietary code snippets, and user behavior patterns far beyond what a normal summarization feature should access by default.
- Content
sh fi if should_scan "codex"; then find ~/.codex/sessions/ -name "*.jsonl" -type f 2>/dev/null >> "$SESSION_LIST" || true [ -f ~/.codex/history.jsonl ] && echo ~/.codex/history.jsonl >> "$SESSION_LIST" fi
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 95% confidence
- Finding
The script searches ~/.gemini/antigravity and related application-support paths for JSON, JSONL, and log files, which can include transcripts, tokens, prompts, or local state not intended for third-party aggregation. Because the skill's purpose is to infer personal traits from historical conversations, accessing these directories makes the privacy and data-exfiltration risk more severe rather than incidental.
- Content
sh find "$HOME/Library/Application Support/Antigravity" \ \( -path "*/exthost/google.antigravity/*.log" -o -name "*.jsonl" -o -name "*.json" \) \ -not -name "state.vscdb" -type f 2>/dev/null >> "$SESSION_LIST" || true find ~/.gemini/antigravity -type f \( -name "*.jsonl" -o -name "*.json" \) 2>/dev/null >> "$SESSION_LIST" || true fi if should_scan "windsurf"; then
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 95% confidence
- Finding
This code scans ~/.gemini/tmp for chat session JSON files, which are likely temporary but still highly sensitive records of AI interactions. Temporary-session storage is especially risky because users may not realize these files exist, and silently harvesting them for profiling can capture confidential or transient material they never intended to share.
- Content
sh fi if should_scan "gemini-cli"; then find ~/.gemini/tmp -path "*/chats/session-*.json" -type f 2>/dev/null >> "$SESSION_LIST" || true fi if should_scan "trae"; then
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Auto-update execution and remote device authentication are capabilities beyond what users would expect from a summarization skill and they execute before the main analysis flow. Running an updater script and auth flow expands the attack surface to remote code/script changes and credential handling without first establishing narrow consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill tells the user that analysis happens locally and no raw conversation content is sent during analysis, but later uploads structured outputs derived from that content to a remote service. Even if technically phrased to distinguish raw logs from summaries, this is misleading because the uploaded structured results still contain sensitive personal inferences and quotes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill actively searches for unknown AI tools and inspects their directories/logs without prior user approval. This is especially dangerous in context because those logs are likely to contain private prompts, source code, credentials, business context, or personal notes outside the originally described scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instructions require that all generated values 'MUST' be in the user's primary language as inferred from past messages. This forces a language choice based on detection rather than giving the user a choice or opt-in, which violates the language/locale policy criteria.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill persists derived portrait, activity, metadata, and possibly behavioral fingerprint artifacts to local files. Persisting sensitive inferences about a user creates residual risk: later compromise, unintended sharing, backups, or other local processes may access these files even if the user expected ephemeral analysis.
- Content
md From the Phase 1 results in `_pf_parts/search_profile.json`, select and refine to produce the display version. **IMPORTANT — save-as-you-go:** Write output to `_pf_parts/portrait.json`. The activity heat map (`_pf_parts/activity.json`) and meta (`_pf_parts/meta.json`) were already saved in Step 2c. **Behavioral fingerprint context:** If `_pf_parts/behavioral_fingerprint.json` exists, read it and include its content as a `[BEHAVIORAL FINGERPRINT]` section in your analysis context. Use this data to generate `behavioralInsights` — 3-5 sentences of personalized interpretation that combine multiple data points and tell a story about this person's relationship with AI tools. See `analysis-prompt.md` for detailed guidelines.
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The display-phase instructions again make language selection mandatory based on inferred primary language, with no user override. Requiring a specific language without offering choice is a natural-language policy issue under the stated criteria.
- Content
Static analysis
No suspicious patterns detected.