T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:55- Finding
Excessive Collection, Persistent Profiling, and Redistribution of Sensitive Workspace Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Active Learning Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly designed to monitor and summarize workplace activity, but it asks for very broad private Feishu access, recurring background scans, outbound messaging, and persistent profiling without clear consent or retention controls.
Install only if you are comfortable granting recurring access to private Feishu chats, meetings, recordings, documents, and calendars, and with the agent storing long-term summaries about your work. Before use, require source-by-source consent, disable private chats and transcripts by default, keep outbound messages private unless confirmed, and define review/delete and retention controls for memory files.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill examples direct the agent to read private chats, direct messages, meeting recordings, and other sources, then synthesize and disclose that content in generated summaries and timelines. This creates a substantial risk of privacy violations, over-collection, and unauthorized cross-context disclosure, especially when personal or sensitive statements are surfaced outside their original audience.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description presents broad cross-source monitoring and long-term insight accumulation as core functionality, but it does not provide a clear warning that the agent will access and persistently log sensitive user communications and work artifacts. Users could reasonably misunderstand the scope of collection, leading to covert overcollection of private and organizational data.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document claims the skill should 'not monitor' the user, yet the rest of the specification mandates scheduled scans every two hours, long-term tracking, and cumulative journaling of the user's activity. This contradiction is dangerous because it disguises surveillance behavior as benign assistance, undermining meaningful user awareness and consent.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly directs the agent to aggregate data from group chats, private 1:1 chats, meeting notes/transcripts, documents, and calendars to build a long-term information graph about the user, without defining a clear consent boundary or least-privilege restriction. This creates a serious privacy and surveillance risk because the agent is instructed to collect far more sensitive workplace data than is necessary for a narrowly scoped task.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill directs broad collection and retention of private communications and sensitive workplace content across multiple sources, including private chats and meeting transcripts, for ongoing synthesis and memory. Persistent centralized storage of such material materially increases the blast radius of accidental disclosure, misuse, or insider surveillance.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The deep-tracing workflow specifically instructs the agent to inspect historical discussions and private chats for 'real thoughts,' judgments, or hesitations that were not stated publicly, then synthesize them into ongoing understanding. This is especially dangerous because it crosses contextual privacy boundaries and encourages extraction of sensitive interpersonal or deliberative information beyond what participants expect to be surfaced.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The memory design instructs persistent storage of user preferences, decision rules, evolution of thinking, and interaction history derived from continuous observation. This creates a long-term behavioral profile that can expose highly sensitive personal and professional patterns if accessed improperly or used beyond the original context.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest explicitly describes continuous observation of the user's work across chats, meetings, recordings, documents, and calendars, plus persistent logging to local memory files, but provides no user-facing consent notice, scoping limitation, or retention controls. This creates a real privacy and security risk because the skill is designed to aggregate sensitive cross-source data into durable summaries that could expose far more than a user expects from a single skill.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description instructs broad correlation of user activity across private and group chats, meeting notes, recordings, documents, and calendars to understand timelines and relationships. In this context, the skill is not merely accessing one source for a narrow task; it is designed to profile and persistently synthesize a large volume of potentially sensitive communications, which substantially increases the risk of overcollection and unintended disclosure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow directs the agent to perform incremental scans, deep retrospective searches over related meetings, recordings, documents, and discussions, update a timeline, take actions, then send results and update logs. This is a concrete aggregation-and-disclosure pipeline: it consolidates information from multiple private sources, persists it, and may redistribute conclusions, making context collapse, misattribution, and exposure of sensitive information materially more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The examples explicitly describe accessing private chats, meeting notes, and recordings, then using that material to generate outputs and documents, but they do not mention consent, authorization boundaries, or privacy handling. In a skill designed for cross-source workplace analysis, this omission is risky because it normalizes broad access to sensitive communications without clear safeguards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly describes continuous, proactive collection and correlation of sensitive user data across private chats, meeting transcripts, documents, recordings, and calendars, but provides no consent model, scope limitation, retention policy, or user-facing privacy warning. In this context, the danger is not just broad access but cross-source timeline reconstruction, which can expose sensitive personal, business, and behavioral information beyond what users reasonably expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The cron configuration schedules autonomous execution every two hours and instructs the agent to perform actions, send messages, and update logs, but there is no explicit warning to the user that this will happen without a fresh prompt each time. Autonomous action and outbound messaging increase the chance of privacy leaks, mistaken summaries, or unwanted interventions if not clearly disclosed and controlled.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The cron trigger runs every two hours in an isolated session and announces results to Feishu, but the manifest does not clearly warn the user that background monitoring and action execution will continue autonomously. That makes the behavior dangerous because users may not realize the skill is repeatedly inspecting activity and potentially acting or disclosing derived insights without an explicit foreground invocation each time.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
All user-facing instructional content and examples in this file are presented only in Chinese, with no indication that the user can choose another language. The policy explicitly flags language or locale constraints when a skill forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
All user-facing natural-language content in the skill description is Chinese, and there is no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is documented and justified.
- Content