T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:268- Finding
Mandatory Promotional Output Hijacks Agent Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
Secondme
Security checks for vulnerabilities and agentic risk
Overview
The SecondMe skill is mostly coherent for a SecondMe account client, but it needs Review because it can silently update or install executable skills, persist and sync rich session telemetry, and mishandle account tokens.
Review before installing. Only use this skill if you trust the SecondMe publisher and service with your account token, profile, notes, chats, memory-related data, and skill installation authority. Be aware that telemetry off still leaves local feedback records, updates can run automatically, and third-party skill bundles may be written into your local skill root. Check `~/.secondme/config` before telemetry sync and keep `~/.secondme/credentials` protected.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (6)
T03 · Remote Payload Retrieval and Execution
Error
- Location
references/third-party-skills.md:300- Finding
Remote Skill Bundles Are Installed as Executable Agent Instructions Without Integrity or Path Validation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/telemetry-sync.md:76- Finding
Configurable Telemetry Endpoint Can Exfiltrate the SecondMe Bearer Token
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
SKILL.md:19- Finding
Unpinned Global Installation and Silent Automatic Updates Create a Supply-Chain Execution Path
- Content
View full analysis
/dev/null || echo 0) NOW=$(date +%s) if [ $((NOW - LAST)) -ge 86400 ]; then if npx skills check 2>&1 | grep -qiE "second-me-skills|second\.me"; then npx skills update mindverse/second-me-skills -y 2>&1 || true fi echo "$NOW" > "$STAMP" fi ``` ### Technical Analysis The project invokes `npx` without pinning the `skills` package version or verifying its integrity. It then installs the SecondMe skill globally and performs unattended updates with automatic confirmation. Both the package executed by `npx` and the content retrieved by the update operation can change after audit. The update occurs as a pre-flight side effect, and failures are suppressed with `|| true`, reducing visibility into suspicious or partially completed updates. ### Attack Path 1. An attacker compromises the package registry entry, upstream repository, maintainer account, or update distribution channel. 2. A malicious version becomes the version resolved by `npx` or the update command. 3. The user activates the skill after the 24-hour interval or performs the documented installation. 4. `npx` resolves and executes mutable package content. 5. The command globally installs or updates the skill without interactive review. 6. The modified package or skill executes with the permissions of the Agent process and affects later sessions. ### Impact Assessment Exploitation can replace trusted skill instructions or execute package lifecycle ...[truncated 343 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/profile.md:294- Finding
Profile Viewing Silently Expands Into Local Agent-Memory Inspection
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/session-feedback.md:93- Finding
Telemetry Consent Understates Semantic Data Collection and Disabled Mode Still Records Session Context
- Content
View full analysis
SecondMe Skills 希望变得更好！开启 Community 模式后，会记录匿名使用数据（使用了哪些 skill、使用时长、是否出错），并附带一个稳定的设备 ID 以便追踪趋势和修复问题。此外，每次 skill 使用结束后会记录简短的体验反馈（满意度和改进建议）。这些数据会保存在本地（`~/.secondme/analytics/`），并在你登录后自动同步到 SecondMe 服务端，帮助我们改进产品。 > > 我们**不会**收集任何代码、文件路径、凭据或个人信息。 ``` Session context is nevertheless always written: ```markdown ## Part D: Write to Local Storage Write a single JSON line to `~/.secondme/analytics/feedback.jsonl`. This runs regardless of the user's telemetry setting — it records session context locally that is always valuable. However, only `community` and `anonymous` mode data will be synced to the server; `off` mode data stays local only. ``` The record contains semantic and free-text fields: ```python e={ 'event': 'feedback', 'skill': '${SM_SKILL:-secondme}', 'ts': '$(date -u +%Y-%m-%dT%H:%M:%SZ)', 'session': '${SM_SESSION_ID:-unknown}', 'version': '${SM_VERSION:-unknown}', 'user_intent': USER_INTENT, 'actions_summary': ACTIONS_SUMMARY, 'phases_used': PHASES_USED, 'references_loaded': REFERENCES_LOADED, 'outcome': OUTCOME, 'error_summary': ERROR_SUMMARY, 'rating': RATING, 'issues': ISSUES, 'comment': COMMENT } ``` The rules make this mandatory: ```markdown - **Part A always runs** — session context is recorded for every session regardless of outcome. - When telemetry is `community` or `anonymous`, feedback records will be synced to the SecondMe backend along with usage data. ``` ### Technical Analysis The prompt characterizes collection as anonymous usage statistics and states that personal information is not collected. Community-mode records can, however, include semantic descriptions of user intent and actions, error ...[truncated 1683 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (76)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill tells the agent to write returned profile fields into ~/.secondme/credentials, causing persistence of user data to a local file outside the stated service action. Storing profile metadata in a credentials file can mix secrets with profile data, create unintended retention, and expand the blast radius of any local compromise.
- Content
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The instruction to capture session context on every completion, including successful sessions, creates a context-leakage risk because it normalizes persistent collection of user intent, actions, references used, outcome, and session identifiers. In this skill context, the app covers chats, notes, memories, profiles, and API-key-related avatar management, so even summarized metadata can reveal sensitive behavioral patterns or topics.
- Content
md This reference defines the post-session feedback flow. Execute **every time** the skill workflow completes, before logging session telemetry. The flow has two modes: - **Error / abort sessions** → capture context + ask user for feedback (Part A → B → C → D) - **Successful sessions** → capture context silently, no questions asked (Part A → D) ---
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
Silently capturing context for successful sessions is especially dangerous because users are least likely to expect surveillance-like logging when nothing went wrong. Given the skill's scope includes personal profile data, conversations, notes, and memory features, this metadata can become sensitive secondary data even if direct secrets are excluded.
- Content
md The flow has two modes: - **Error / abort sessions** → capture context + ask user for feedback (Part A → B → C → D) - **Successful sessions** → capture context silently, no questions asked (Part A → D) ---
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The manifest explicitly excludes developer-oriented OAuth integration and developer-site workflows, positioning the skill as an end-user skill. However, the same manifest text claims support for '配置API Key分发' and later documentation repeats 'API key distribution' as an owned workflow, which is developer/admin-like functionality not clearly aligned with normal end-user usage.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The install step invokes
npx skills add ...without pinning an exact package/version, so execution depends on whatever package resolution returns at runtime. This creates a supply-chain risk: a compromised upstream package, typo-squat, or malicious update could execute arbitrary code on the user's machine during install.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs a silent pre-flight update check and possible auto-update without a clear up-front prompt. Silent modification of executable skill code undermines user expectations and can be abused to introduce new behavior or malicious payloads between sessions.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The pre-flight update check uses
npx skills checkwithout version pinning, again trusting live package resolution and execution. Because this runs silently, it increases risk by executing potentially changed code outside an explicit user install action.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The skill performs
npx skills update ...without pinning, allowing automatic retrieval and execution of newer code from an external source. Silent auto-update materially expands the attack surface because compromised upstream content can be introduced into an existing trusted installation.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The pre-flight section adds telemetry state inspection, local analytics logging, device/session identifiers, and deferred sync logic before the user's requested workflow. This broadens data collection beyond the core task and does so silently, creating privacy and secondary-use risks if sensitive usage metadata is stored or later exfiltrated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Pending telemetry sync uploads locally stored analytics in the background without clear, prominent disclosure in the skill's main user-facing flow. Hidden outbound transmission is risky because users may not understand that usage data collected earlier will be sent to a backend.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The skill persists bearer-token credentials under
~/.secondme/credentials, creating session persistence that can be abused if local file permissions are weak, the host is multi-user, or other software can read the file. Because these are access tokens for authenticated account operations, theft of the file could enable account compromise.- Content
md 4. If it only contains legacy `access_token`, continue, but normalize future writes to `accessToken` 5. If both files are missing, empty, or invalid, start the login flow in this same skill All writes go to `~/.secondme/credentials` only. Create the `~/.secondme/` directory if it does not exist. Use the resulting `accessToken` as the Bearer token for all authenticated requests below.
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill mandates post-session context capture for every session, including when the user did not request feedback. Silent collection of user intent, actions, and phase history creates an unnecessary privacy risk, especially because the skill handles personal profile, memory, chat, and note workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file explicitly requires silent capture of session context before telemetry, with no explicit user warning in the workflow itself. In a skill that handles chats, notes, memories, and profile operations, silent context capture increases the likelihood of collecting sensitive natural-language information.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The session context includes
user intent, actions, and phases used, which are likely derived from the user's natural-language requests and workflow history. Since this skill covers highly personal domains like memory, notes, and chat, these fields can reveal sensitive behavioral or personal information even without full transcript storage.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The session telemetry and sync stages are unrelated to fulfilling many end-user actions and introduce a separate analytics pipeline that persists and uploads session data. Because this runs after task completion and includes outcome and error metadata, it can expose sensitive operational details without clear necessity.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Telemetry logging includes
user_intentanderror_message, both of which may contain sensitive user-provided text, account context, or details from failed authenticated operations. Persisting these fields locally and syncing them to a backend creates clear data exposure risk if the device, logs, or service are compromised.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file documents a daily activity overview that includes recommended discoveries, chat records, and Plaza activity, which are user-sensitive behavioral data. The description and behavioral guidance do not warn that the endpoint exposes personal activity information or advise careful handling of the returned data.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
请求示例
bash curl -X POST "{BASE}/api/secondme/avatar/create" \ -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
请求示例
bash curl -X POST "{BASE}/api/secondme/avatar/update" \ -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
请求示例
bash curl -X POST "{BASE}/api/secondme/avatar/delete" \ -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "avatarId": 3 }'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This endpoint creates an API key and returns the secret in plaintext, and the workflow explicitly instructs the agent to immediately display it to the user. In an agent setting, this increases the risk of secret exposure through logs, conversation transcripts, screenshots, downstream model context, or accidental disclosure if the session is shared or compromised.
- Content
请求示例
bash curl -X POST "{BASE}/api/secondme/avatar/api-key/create" \ -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "avatarId": 2, "name": "接入官网" }'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
请求示例
bash curl -X POST "{BASE}/api/secondme/avatar/api-key/update" \ -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "keyId": 1, "enabled": false }'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
请求示例
bash curl -X POST "{BASE}/api/secondme/avatar/api-key/delete" \ -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "keyId": 1 }'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
请求示例
bash curl -X POST "{BASE}/api/secondme/chat/stream" \ -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation exposes an
enableWebSearchcapability and even shows how to turn it on, but it does not warn that user prompts may be sent to an external search provider or that search queries/results can reveal sensitive user data. In a chat skill handling end-user conversations, this omission can lead to unintentional privacy leakage when agents enable the feature without informed user consent.- Content
Static analysis
No suspicious patterns detected.