Security audit

Personal Understanding v2

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local personal-memory skill, but it broadly stores sensitive conversations and files by default and can change AI-client configuration, so users should review it carefully before installing.

Install only if you deliberately want a durable local archive of personal conversations and files. Before use, review the MCP auto-registration behavior, disable or avoid cloud/rclone backups unless you intentionally configured them, decide whether retrieval traces and turn receipts are acceptable, and confirm you know how to inspect or delete data under `memory/`, `sources/`, and `backups/`.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill directs the agent to proactively check prior disclosures and initiate follow-up prompts, which goes beyond passive recall and can resurface sensitive personal data without a fresh user request. In a personal-memory skill, this increases privacy and consent risk because previously stored emotional, relational, or health-related content may be brought back into conversation unexpectedly.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill instructs the agent to run an installation script that registers an MCP service and asks the user to restart the session if tools are missing. That is a host-configuration change unrelated to normal memory retrieval, and it creates a dangerous path for modifying the user's environment from within a skill instruction.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Machine-wide AI client detection and registration expands the skill's authority from personal-memory handling into system discovery and configuration management. This broadens the attack surface and could let a compromised or overly trusted skill alter multiple clients or persistence points on the host.

Intent-Code Divergence

High

Confidence: 92% confidence
Finding: The module-level documentation says the script only writes under backups/, but the implementation can also mirror the full archive to an arbitrary configured path or removable drive. That mismatch is dangerous because operators or downstream automation may grant trust or permissions based on the documented behavior, causing unintended data exfiltration or overwriting of files outside the expected backup area.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The docstring states the script will 'emit an automatic deep-review execution alert when due,' but the implementation actually runs the review cycle. This discrepancy can mislead reviewers or users into believing the script only notifies, when it in fact causes code execution and any side effects of the downstream workflow.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The module advertises the operation as read-only, but the code can write to memory/review-state.json when invoked with --mark-reviewed. This kind of misleading safety boundary can cause operators or higher-level automation to run the script under false assumptions, leading to unintended state changes and weakening audit integrity.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The user-facing console output says the deep review phase is read-only even though the same invocation may mutate review-state when --mark-reviewed is supplied. This discrepancy increases the chance of accidental writes by humans or orchestration systems that rely on output text for confirmation of side effects.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The README explicitly says the skill triggers on broad phrases like 'I've been feeling…', 'remember that…', and generally on 'personal content,' which overlaps heavily with normal conversation. In a skill context, this can cause over-broad activation and unintended capture/processing of sensitive personal data during ordinary chats, especially because the project is designed to store verbatim user messages persistently.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The README states the skill will auto-trigger on very broad, everyday phrases like '我最近……' and '记住一下……', which creates an overly permissive activation boundary for a memory-capture skill. In context, that means normal conversation can silently invoke archival behavior and cause collection of sensitive personal data when the user may not have intended to activate persistent memory.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README explicitly describes automatic capture and local storage of users' full original messages, including hashes, timestamps, and session identifiers, but the activation example does not pair this with an immediate privacy warning or consent checkpoint. Even though storage is local, silently persisting raw conversations increases privacy risk because users may disclose sensitive data in ordinary chat without realizing it will be permanently archived.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill mandates saving the user's exact words first, but the front matter does not provide a clear upfront warning that complete personal messages will be retained. For a personal archive, this is dangerous because users may disclose intimate information without understanding the retention model or immutability requirement.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill explicitly stores original images, audio, and files, but it does not clearly warn users that raw attachments themselves—not just summaries or extracted text—will be retained. Original attachments can contain highly sensitive metadata and content far beyond what the user expects the assistant to remember.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The skill metadata explicitly says '默认用中文工作', which sets Chinese as the default operating language without clear user opt-in. This is mainly a consent and usability issue rather than a direct security exploit, but it can cause the agent to mishandle user expectations, misunderstand instructions, or silently process sensitive personal content in a language the user did not choose.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The activation rule is extremely broad and triggers on common categories of ordinary conversation such as preferences, experiences, current state, and collaboration rules. In practice this can cause over-collection of personal data by default, capturing far more user content than is necessary and increasing privacy, retention, and misuse risk.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The policy explicitly requires writing the full user message before any derived processing, but it does not require notice, consent, minimization, retention limits, or handling rules for sensitive data. This creates a direct privacy and compliance risk because highly sensitive content may be persistently stored even when unnecessary for the task.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger conditions are broad and partly subjective, such as activating on repeated condition–response patterns, when a decision 'requires comparing causes,' or when a 'deep review' finds shared mechanisms. In a policy governing causal hypothesis generation, this can cause the system to invoke speculative reasoning in situations where the user did not clearly request it, increasing the risk of overreach in sensitive reflection or self-evaluation contexts.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The policy explicitly says that once the backup is overdue, the reminder appears and the model executes the backup automatically, while the backup design includes pushing archived snapshots to a WebDAV cloud drive. That creates a data-transfer action involving personal archive contents without a clearly stated per-run user confirmation or prominent warning at the point of execution, increasing the risk of unintended exfiltration of sensitive data to a remote service.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: This trigger set includes very broad everyday terms such as "budget," "expenses," and "no money" that can appear in many benign conversations without indicating the intended sensitive transition context. In a proactive cueing system, such collisions can cause unwarranted inference about finances, responsibility, or privacy boundaries, leading to intrusive or misaligned responses.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: Terms like "good person," "passion," "kindness," "moving," and "cried" are highly ambiguous and commonly used in ordinary speech, making reliable activation difficult. This can cause the system to infer moral or emotional states from weak evidence and steer conversations inappropriately based on false positives.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: Phrases such as "the analysis is wrong," "privacy," "gossip," and "that's not me" are broad, emotionally loaded, and likely to appear in many contexts unrelated to the intended boundary-correction signal. Misfiring on these phrases is particularly risky because it touches source attribution and personal-space concerns, which can make the assistant appear invasive or defensive.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly documents persistent logging of retrieval traces to disk, including queries, time windows, selected or stopped IDs, and capture associations, while also stating that traces are not shown to the user by default. In a personal-skill context, those fields can reveal sensitive user behavior, memory access patterns, and linked identifiers without clear user notice or consent, creating privacy and data-governance risk even if the feature was intended for debugging.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The policy explicitly allows reading sensitive personal content when deemed relevant and persisting retrieval decision traces, but it provides no accompanying requirement for user notice, consent, minimization, or trace-access controls. In a personal-context retrieval skill, this creates a real privacy and data-governance risk because sensitive data may be accessed and audit artifacts stored without transparent user-facing safeguards.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The policy explicitly instructs the agent to write follow-up details, including the original question, context, and source, into persistent storage without any requirement to notify the user or obtain consent. That creates a privacy risk because potentially sensitive conversational data may be retained and resurfaced later outside the user's expectation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The repeated instructions to retain the original loop record and save the user's later answer verbatim reinforce indefinite or extended persistence of conversational state without any privacy warning, retention limit, or deletion workflow. This increases the chance that sensitive personal information is stored longer than necessary and reused in future interactions without clear user awareness.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The script reads sensitive local archive state, including record counts, follow-up presence, and days since last conversation capture, and exposes those details in its JSON output without any explicit consent, authorization check, or user-facing disclosure. In a memory/archive skill, this can leak private behavioral metadata and prompt content context to callers who may not have intended or been permitted to inspect internal archive state.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_derivation_closure.py:140

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_v02.py:65

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_v07_fixes.py:62

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_v08_loops.py:62

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_v09_review_round.py:26