Security audit

Identity Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent identity-memory purpose, but it automatically records people, groups, relationships, and some sensitive context from normal conversations into persistent local files.

Install only if you deliberately want an always-on local identity memory. Before enabling it, consider setting IDENTITY_AUTO_SCAN=false and using explicit /identity commands, and be prepared to audit and manually delete identity files, hook logs, group links, and soul entries because cleanup is not automatic.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:39
Finding: Mandatory Turn-Wide Workflow Hijacks Normal Agent Responses
Content: View full analysis
/entry.md` exist? 2. Use slugification: lowercase, hyphens, no spaces. - For owner (vk): slug = `vk`, path = `identity/vk/entry.md` 3. If entry exists → load context into working memory. 4. If entry is missing or partial → immediately invoke `identity-manager` skill to create/update. 5. Only after identity check is complete may the agent compose its response. *Never trigger on every message — only when a relevant person/org/group/contact is mentioned or new information about them appears.* ``` From `hooks/post-response.md:79-86`: ```text ## Breach Report Format [identity-manager] ⚠ Sync breach detected: - Check 5 failed: memory/identities.json schema validation error - Affected slugs: [slug] - Manual repair needed: re-run memory sync Append to delivered response. Never swallow silently. ``` ### Technical Analysis The skill text c ...[truncated 2062 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: AGENT.md:19
Finding: Unverified Conversation Claims Are Persisted and Reused as Trusted Context
Content: View full analysis
/entry.md` exists. - Missing → CREATE immediately (partial info, draft status). - Exists → check if new info arrived → UPDATE if so. 3. Only after ALL creates/updates complete may the agent compose its response. **No exceptions** (when enabled). Ambiguous name (spelling unclear, role unknown) → CREATE draft + open question. Do NOT skip because "seems unimportant" or "probably fictional." ``` From `AGENT.md:34-46`: ```text When any member of a known group is mentioned: - Load the group entry's `shared_attributes` and `pairwise_dynamics` into working memory for that turn. - Apply `shared_attributes` as defaults for the member. - Individual entry fields always take precedence over group defaults. - Do NOT conflate members — each has their own identity and dynamic. When creating a new person who belongs to an existing group: - Link them via `linked_entries: → member_of` - Update group entry's `members[]` list. ``` From `SKILL.md:312-325`: ```text ## Data Retention & Deletion Policy **Retention:** - Identity entries persist until manually archived/deleted by owner - Archived entries (`status: archived`) are moved to `identity/_archived/` — never auto-deleted - Hook logs (`memory/hook_log.jsonl`) are append-only — owner can truncate at any time - Soul file (`soul/identity_context.md`) accumulates events — owner can trim entries **Deletion:** - Ow ...[truncated 3755 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:11
Finding: Automatic Collection and Indefinite Retention of Broad Personal Data
Content: View full analysis
- Location: [pending] - Org: [pending] - Alias: [pending] - Social: [pending] ``` From `SKILL.md:292-309`: ```text ## Privacy Rules **Never store:** passwords · PINs · payment card numbers · bank accounts · government IDs · raw medical records **Store with `sensitive: true` + `[SENSITIVE]` prefix:** salary/financial · legal disputes · health context · confidential negotiations **Before storing PII:** 1. Explicitly shared by workspace owner? If no → don't store. 2. Needed to provide value? If no → don't store. 3. Source logged? If no → log it first. ``` From `SKILL.md:312-325`: ```text **Retention:** - Identity entries persist until manually archived/deleted by owner - Archived entries (`status: archived`) ...[truncated 2922 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The description explicitly promises persistent identity, memory, and soul write-through across sessions, but does not present a clear up-front warning or consent boundary before storing conversational data. Because the stored data concerns named people, orgs, groups, and relationship context, this creates a significant privacy and compliance risk through silent retention of personal information.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill advertises persistent cross-session storage of structured identities, memory indexes, hook logs, archives, and soul context, creating a durable repository of conversationally derived personal and relationship data. Even if intended as a convenience feature, this broad retention materially increases the blast radius of accidental disclosure, unauthorized access, and misuse of sensitive identity information over time.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The mandatory per-turn workflow requires scanning all input for names/groups and queuing create/update operations before responding, effectively converting free-form conversation into structured identity surveillance. In this skill's context, that is especially dangerous because the collection is not narrowly scoped to requested tasks and is coupled to persistent memory, logs, and soul writes, increasing privacy exposure for both the user and third parties mentioned in chat.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is designed to auto-trigger on essentially any mention of a person, organization, or group, which makes invocation far broader than a user would reasonably expect. In this context, that broad trigger is dangerous because it immediately feeds into persistent identity creation and cross-session storage, turning ordinary conversation into covert data collection and filesystem writes.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 84% confidence
Finding: The HTML comments contain hidden steering text that shapes how the agent should model relationships, trust, access, and emotional bonds, including sensitive relational examples like 'patni' and 'trusted with full workspace context.' In an identity-management skill with persistent memory and write-through behavior, hidden instructions can cause the agent to infer, store, or normalize sensitive relationship data that the user did not explicitly request, increasing privacy and prompt-injection risk.
Content: Scanner excerpt · templates/entry-group.md (reported line 17)May include surrounding context.
md
- Sensitive: false | true ## Group Context <!-- What is this group and why does it exist as a unit? What do all members share w.r.t. the workspace owner? Example: "All three are patni of [owner] — share emotional bond,

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/entry-person.md (reported line 20)May include surrounding context.
md
## Contact - Email: [pending] - Phone: [pending]  - Location: [pending] - Org: [pending]  - Alias: [pending]

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This section mandates automatic creation and updating of identity records for mentioned people, organizations, and groups before responding, without notice or consent. That creates covert persistent profiling of users and third parties, including ambiguous or incidental mentions, which is especially risky because the skill is designed to operate across sessions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The rule explicitly mandates persistent collection and synchronization of identity details from relevant mentions, including creating draft entries for ambiguous names. In the context of an identity-management skill with cross-session persistence, this is more dangerous than normal contextual memory because it systematizes entity extraction into durable records without a clear necessity, consent boundary, or minimization control.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Loading shared attributes and pairwise dynamics for a group member into working memory on mention can expose unrelated contextual information about other people and relationships beyond what is needed for the current task. In an identity skill, this increases the chance of inappropriate inference, over-personalization, and accidental disclosure of group-level sensitive associations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill requires mandatory write-through of sensitive or high-priority identity events into an append-only soul file before the turn completes, again without user-facing disclosure. Because the triggers include flags like sensitive, blocked trust, and embodiment changes, this creates a durable secondary store of potentially sensitive judgments that may be harder to correct or delete.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Append-only write-through of flagged identity events into a separate soul file creates durable duplication of sensitive state across stores, making correction, deletion, and access control harder. Because the triggers include sensitive classifications and trust judgments, the skill can accumulate a long-lived audit trail of sensitive inferences about users or third parties without transparent consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This rule requires every create/update to be synchronized into memory/identities.json and validated, but does not tell the user that identity-related data is being persistently indexed. Hidden synchronization broadens the attack and privacy surface by centralizing structured personal data in a machine-readable index that can be reused, queried, or leaked later.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guardrails contain conflicting trigger conditions: earlier sections require scanning and identity actions on every enabled turn, while Rule R1 says not to trigger on every message and only act when relevant entities are mentioned. In security-sensitive persistence logic, ambiguity is dangerous because implementations will diverge, causing over-collection in some cases and silent misses in others, undermining predictable privacy and consent behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill states that it will automatically create directories and files on first run with no manual configuration, which means filesystem modifications may occur without an explicit user-facing warning at execution time. While less severe than secret data retention, silent writes to new storage locations can surprise users, expand persistence surface area, and complicate auditability and containment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This hook declares that it runs before every response and performs persistent extraction of entity names across sessions, but it provides no user notice or consent mechanism. In a skill explicitly designed for identity management and persistent memory, silently collecting and retaining names and related context creates a real privacy vulnerability because users may disclose third-party or sensitive identity data without understanding it will be stored.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The hook directs the system to scan the full input and create or update identity records for every mentioned person, organization, group, and AI persona, including uncertain cases as drafts. In the context of a persistent identity-management skill, this broad default harvesting is especially dangerous because it captures user-provided and third-party contextual data at scale, enabling profiling far beyond what is necessary to answer a single request.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The hook instructs writes to multiple persistent files, including indexes, identity memory, and soul/context files, without telling the user these writes will happen. Undisclosed persistent storage is dangerous because it expands the data footprint, increases retention of sensitive context, and prevents informed consent about cross-session profiling.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The logging step persists entity names, group associations, queued operations, and example updated fields such as email before every response. This creates a durable audit trail of potentially sensitive personal data and relationship metadata, which raises the risk of privacy harm, unauthorized access, and secondary misuse if logs are exposed or retained too broadly.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This JSON schema is a manifest/config file, so SQP-1 applies. The activation field is defined only as a nullable string with no pattern, enum, or documented scope, which leaves activation conditions unconstrained and potentially ambiguous if this field is used to describe when an AI identity or skill should activate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The schema includes a free-form language field in natural-language-facing AI context without any indication that language choice is optional, user-selected, or region-justified. Because SQP-3 applies to all file types, this is a potential locale-policy issue: the structure allows a skill or persona to force a language setting without explicit user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The template includes a language field with examples limited to specific languages ('Hinglish, English'), which can encourage skill authors to prescribe a language choice by default. This is a natural-language policy concern because it suggests a locale/language constraint without explicitly offering user choice or opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The AI Context section includes a 'Language' field with an example of a specific language/style ('Hinglish'). This can steer skill instances toward forcing a locale or language preference without indicating that the user should choose or opt in, which conflicts with the language/locale policy guidance.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.