2nd Brain

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:36 PM UTC
• Version: 1.3.0

Overview

This skill is a coherent personal knowledge-base tool, but it needs Review because it can persist personal details and original media files too broadly and includes an optional unpinned global install step.

Install only if you want a persistent local knowledge base that may store personal details and original files. Use explicit save/delete instructions, avoid storing sensitive third-party information without consent, periodically clean the brain and attachments folders, and skip the optional QMD install unless you can pin and verify the dependency in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Global Installation from a Mutable Git Repository

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 10
Vulnerability Type: Unpinned third-party dependency installed globally from a mutable source
Risk Level: Medium

text

1. Install QMD CLI: bun install -g https://github.com/tobi/qmd

Technical Analysis

The optional setup instructions install QMD globally and directly from a Git repository without pinning an immutable commit, reviewed release tag, package version, or integrity checksum. Consequently, the code installed by this command may change after the Skill has been reviewed.

Package installation can also run dependency lifecycle scripts with the invoking user's privileges. If the upstream repository, its default branch, a transitive dependency, or a maintainer account is compromised, following this instruction could install or execute attacker-controlled code. The global installation flag increases scope by modifying the user's shared Bun environment rather than a project-isolated environment.

The repository URL is clearly disclosed and the installation is described as optional; no evidence establishes that the current upstream project is malicious. The vulnerability is the unsafe, mutable dependency-installation method.

Attack Path

1. An attacker compromises the referenced repository, its maintainer account, or a dependency resolved during installation.
2. The attacker adds a malicious lifecycle script or modifies the QMD executable on the repository's mutable revision.
3. A user follows the documented setup command:

   bash

   bun install -g https://github.com/tobi/qmd
   

4. Bun retrieves the modified source and resolves its dependencies without verification against an audit-pinned revision or checksum.
5. Malicious installation code may execute with the user's privileges, or the globally installed CLI may execute malicious behavior when subsequently invoked.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of t ...[truncated 531 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin QMD to a reviewed, immutable commit hash or a specific trusted release rather than the repository's mutable default revision.
2. Publish and verify a cryptographic checksum or signed release artifact before installation.
3. Prefer a versioned package from a trusted registry with lockfile and integrity metadata, provided package ownership has been independently verified.
4. Install the dependency in an isolated project environment instead of globally unless global installation is operationally necessary.
5. Disable dependency lifecycle scripts during installation where supported, then explicitly enable only scripts that have been reviewed and are required.
6. Document the expected repository owner, approved version, verification procedure, and update-review process.
7. Review transitive dependencies and regenerate the approved lockfile or integrity record whenever upgrading.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to persist information about people, places, preferences, and to always save original media files, but it does not provide any warning about privacy, consent, sensitivity, or retention. This is dangerous because users may unknowingly cause long-term storage of personal data and attachments, including data about third parties, with no notice or deletion/retention guidance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill defines very broad trigger conditions such as common verbs and phrases like 'remember', 'note that', 'who is', and 'where was', which can overlap with ordinary conversation and cause the skill to activate when the user did not explicitly intend persistent storage. In this skill’s context, accidental activation is more dangerous because it routes content into a long-lived knowledge base and gives precedence to that store over daily logs, increasing the chance of unintended retention of personal information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.