Security audit

Pickup Lines

Security checks for vulnerabilities and agentic risk

Overview

The skill is advertised as a romantic-line generator, but the inspected artifact actually saves, logs, lists, searches, and exports user text in local plaintext files.

Install only if you intentionally want a local plaintext pickup-line collection manager. Do not use it for sensitive confessions or private messages unless you are comfortable with the text being saved under ~/.local/share/pickup-lines and later listed or exported; the skill should be revised if you expected actual romantic-line generation or reliable deletion.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill metadata presents this as a harmless romantic-line generator, but the documented behavior is actually a persistent local storage CLI that initializes directories, stores user content, logs activity, and exports full saved data. This mismatch can cause users or orchestration systems to invoke the skill under false assumptions, increasing the risk of unexpected data collection, retention, and disclosure.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The manifest claims a generation/writing-assistance skill, while the body describes a database-like tool for collecting and managing user-provided text in local files. In an agent ecosystem, this deceptive or inaccurate interface can bypass user expectations and policy controls, leading to unintended persistence of sensitive romantic or personal content and later disclosure via list/export commands.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The implemented behavior is materially different from the declared skill purpose: instead of generating romantic lines, the script provides a generic local data-management CLI with storage, search, and export functions. This mismatch is dangerous because it can conceal broader capabilities from reviewers and users, increasing the risk of covert data collection or misuse under an innocuous manifest.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The description is broad enough to match many ordinary writing scenarios, increasing the chance that an agent auto-selects this skill for routine drafting tasks. Because the skill actually stores and manages text rather than merely generating it, overbroad triggering can result in unnecessary collection and retention of private user communications.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The `pickup-lines run <input>` command is described as a general-purpose entry point for quick operations, but its actual behavior is not defined. In a security-sensitive agent environment, ambiguous broad-entry commands make it difficult to reason about side effects and can enable unintended execution paths involving storage, logging, or data exposure.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The inline documentation explicitly describes the script as a 'Multi-purpose utility tool,' which contradicts the Love Lines manifest and reinforces that the implementation is not purpose-limited. Such contradictory labeling is dangerous because it obscures true functionality and can indicate an attempt, or at minimum a failure, to bypass capability-based review expectations.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script creates a persistent data directory, stores entries in local files, and supports export, none of which are justified by a simple romantic-line generator. In this skill context, those capabilities are more dangerous because users would reasonably expect ephemeral text generation, not retention and later extraction of potentially sensitive personal messages or confessions.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The help text advertises generic commands such as init, add, remove, search, and export rather than a romantic-line generation workflow. Exposing undisclosed general-purpose capabilities under a misleading skill identity increases the chance that users or higher-level systems invoke storage and export operations they did not consent to.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The logging helper writes user-supplied command arguments to a history file without notice, which can capture sensitive personal content entered into the skill. Given the stated romantic-use context, inputs may include confessions, names, dates, or private messages, so undisclosed logging materially increases privacy and data-exposure risk.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The add command persists arbitrary user-supplied content to disk without any disclosure that the content will be stored. In the context of a supposed romantic-line generator, users may provide intimate text expecting transient processing, so silent persistence creates an avoidable privacy risk.

Static analysis

No suspicious patterns detected.