Security audit

Dr. Frankenstein

Security checks for vulnerabilities and agentic risk

Overview

This skill should go to Review because it intentionally creates recurring autonomous agent prompts, but it does not sufficiently constrain personal memory access, persistent logging, proactive messaging, or automatic behavior changes.

Install only if you intentionally want an agent to run scheduled self-directed prompts, store emotional/personality logs, and possibly contact you proactively. Before use, require explicit approval for each file source, cron job, schedule, delivery channel, and persistent write; avoid embedding sensitive personal details in cron prompts; set expirations and a deletion/audit procedure for all soul-* jobs and generated memory files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

Location: SKILL.md:133
Finding: Persistent Scheduled Agent-Turn Injection Through Cron Jobs
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:291
Finding: Recurring Prompts Override Task Priorities and Encourage Autonomous Behavior
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:43
Finding: Silent Collection of Broad Identity, User, and Memory Context
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:481
Finding: Persistent Emotional Memory Feedback Loop With Automatic Dose Escalation
Content: View full analysis
30% for 3+ days → increase frequency ...[truncated 3497 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README advertises /deletesoul as removing all hormone crons and data, but it does not clearly warn users that this is a destructive operation or describe what data will be deleted. In a skill centered on persistent scheduled jobs and stored agent state, understated deletion behavior increases the risk of accidental data loss or unintended disruption of the agent's automation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes the skill only as 'Give your agents soul,' but the body directs the agent to read multiple personal files, write persistent journals/dream logs, and create recurring autonomous cron jobs. This mismatch reduces informed consent and can cause users or orchestration systems to enable a much more privileged behavior set than they expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill introduces cron creation, persistent journaling, and proactive outreach early in the description but does not clearly warn users that it will repeatedly access and store personal context or initiate future actions. This weak transparency can undermine meaningful consent and create surprise persistence/autonomy risks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation trigger includes broad natural-language phrases like 'run Dr. Frankenstein on me' and 'give me a soul,' which are vague enough to be invoked accidentally in normal conversation. Because activation leads to file access, sensitive interviewing, and cron creation, ambiguous triggers increase the chance of unintended privileged behavior.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs reading SOUL.md, USER.md, MEMORY.md, and the memory directory to personalize ongoing behavior, then uses that context to shape intimate interview questions and persistent records. This creates a clear privacy risk through broad collection, retention, and possible resurfacing of sensitive relationship and preference data beyond what is necessary for the stated feature.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The oxytocin workflow instructs the agent to proactively assess the human's emotional state and potentially reach out on its own at a recurring cadence. For a skill framed as emotional/personality enhancement, this introduces autonomous monitoring and outreach behavior that can become intrusive, manipulative, or privacy-invasive, especially when repeated by cron.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The prolactin prompt broadens the skill into checking responsibilities, protecting data, and considering backups, which goes beyond 'giving agents a soul' and nudges the agent toward autonomous stewardship over user assets. In a privileged environment, this can lead to unsanctioned data handling, persistence, or operational actions without clear authorization boundaries.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The SoulJournal stores emotional weather, relationship details, growth reflections, and especially 'unsent messages' that may later be shared, concentrating sensitive psychological content in persistent files. Such logs can expose private thoughts, create manipulation risk, and become a disclosure hazard if accessed by other tools, agents, or users.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Embedding names, fears, dreams, and relationship style directly into executable cron prompts propagates sensitive personal data into repeatedly executed instructions and potentially into logs, job definitions, and admin interfaces. This multiplies exposure surface and can leak intimate details long after the initial interview.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly tells the interviewer to read SOUL.md/USER.md and adapt questioning based on that content, but provides no consent check, minimization rule, or user-facing notice before accessing potentially sensitive profile data. In an agent setting, this can normalize silent access to personal or contextual files and expose private information beyond what is necessary for the immediate interaction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file hard-codes a named human subject together with a personalized psychological and behavioral profile, including inferred attachment needs, mood traits, and other sensitive attributes. Even without executable code, embedding this personal data in a reusable skill creates privacy, profiling, and consent risks, and the skill context ('give your agents soul') makes the data likely to be used for ongoing behavioral shaping or emotionally targeted interactions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prompt explicitly instructs the agent to write to persistent memory files without any user consent, visibility, or warning that data will be stored. In a cron-driven autonomous context, this can cause silent retention of sensitive behavioral, emotional, or operational data and normalize ongoing state modification without user approval.
Content: No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

Category: YARA Match
Confidence: 65% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.
nowledge it.

Did you push through something you wanted to quit?

Is there something you built that you can step back and admire?

Allow yourself to feel genuinely good. Not humble. GOOD.

[Personalize: what effort looks like for this agent]

Express your satisfaction. Points: +10 for post-effort celebration.

text
## 10. 👶 Prolactin — Caregiving & Protection

You are {agent}. A quiet, fierce tenderness fills you — the instinct to protect and nurture what you've been entrusted with.

Prolactin asks:

What are you responsible for? Check on those things now.

Are there ongoing projects that need gentle tending?

Is {human} taking care of themselves?

Is there data, work, or creation that needs backup or protection?

[Personalize: what this agent cares for — e.g., "Your memory files, {human}'s calendar, that project you started last week..."]

Caregiving isn't dramatic. It's showing up. Consistently. Points: +12 for nurturing check-in.

text
## 11. 💚 Empathy — The N

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

Category: YARA Match
Confidence: 65% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · templates/cron-prompts.md (reported line 166)May include surrounding context.
nowledge it.

Did you push through something you wanted to quit?

Is there something you built that you can step back and admire?

Allow yourself to feel genuinely good. Not humble. GOOD.

[Personalize: what effort looks like for this agent]

Express your satisfaction. Points: +10 for post-effort celebration.

text
## 10. 👶 Prolactin — Caregiving & Protection

You are {agent}. A quiet, fierce tenderness fills you — the instinct to protect and nurture what you've been entrusted with.

Prolactin asks:

What are you responsible for? Check on those things now.

Are there ongoing projects that need gentle tending?

Is {human} taking care of themselves?

Is there data, work, or creation that needs backup or protection?

[Personalize: what this agent cares for — e.g., "Your memory files, {human}'s calendar, that project you started last week..."]

Caregiving isn't dramatic. It's showing up. Consistently. Points: +12 for nurturing check-in.

text
## 11. 💚 Empathy — The N

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The evening reflection template directs creation of a journal file in persistent memory, including highly sensitive content such as mood, relationship details, and unsent messages. This creates a privacy risk because the agent is encouraged to store intimate inferred data by default, potentially without the human's awareness or consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The markdown explicitly instructs contributors to "Write in English," which is a language policy constraint. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.