Security audit

人物关系管理

Security checks for vulnerabilities and agentic risk

Overview

This skill is a contact-memory helper, but it persistently stores detailed personal profiles with limited consent, minimization, or deletion guidance.

Install only if you are comfortable with the agent keeping persistent contact profiles. Avoid storing sensitive notes, ask before saving third-party details, and prefer aliases or platform handles over real names and gender unless they are truly needed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:44
Finding: Persistent Overcollection of Personally Identifiable Information
Content: View full analysis
"For this person: > - What is their real name? > - What is their gender? > - What nicknames do they have? > - What is their name on Douyin? > - What is their name on WeChat? > - Is there any other information, such as occupation or relationship?" ### Step 2: Store the information in memory Use `memory_store` to save: Person profile: XXX, gender X, nicknames XXX and XXX, Douyin name XXX, WeChat name XXX, notes: XXX ## Memory Format Person profile: real name, gender X, nicknames nickname1 and nickname2, platform name XXX, notes: XXX Required fields: real name and gender Optional fields: nicknames, platform nicknames, and notes ``` ### Technical Analysis The Skill directs the agent to collect and persistently store personally identifiable information about third parties. The collected fields include real names, gender, social-platform identities, occupation, personal relationships, and unrestricted notes. This exceeds the minimum information required for the stated purpose of resolving a recipient's platform nickname. In particular, gender is mandatory even though it is not required to identify a messaging destination. Free-form notes can also contain additional sensitive or confidential information. The instructions provide no controls for: - Explicit consent before persistent storage. - Notice that the information will remain in long-term agent memory. - Data minimization or purpose limitation. - Retention periods or automatic expiration. - Reviewing, correcting, or deleting stored profiles. - Restricting later retrieval to the user or task that created the record. - Preventing sensitive information from being entered in free ...[truncated 2205 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill directs the agent to collect and persist real names, gender, nicknames, platform handles, and relationship notes in memory, but provides no privacy notice, consent step, retention limit, or data minimization guidance. Because this is a cross-platform identity profile tied to real people, it can expose sensitive social graph information and facilitate unauthorized contact, profiling, or long-term privacy harm if misused or recalled in the wrong context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill makes gender a required field and explicitly instructs the agent to collect and store it, even though gender is not necessary to resolve a platform handle in most cases. This creates unnecessary collection of sensitive personal data without opt-in, purpose limitation, or minimization, increasing privacy and compliance risk if memory is retained or reused later.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger conditions are broad enough to activate during ordinary requests like contacting someone, causing the skill to automatically query or store personal relationship data even when the user did not intend to use memory. In a skill that handles identity data and messaging handles, unintended activation materially raises the chance of over-collection, incorrect recall, or silent persistence of private information.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.