T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:66- Finding
Persistent Plaintext Storage of Personal and Residence Data Without Consent Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Fengshui Advisor — 风水顾问
Security checks for vulnerabilities and agentic risk
Overview
The skill appears non-malicious, but it persistently stores personal and residence details and automatically imports another skill's memory without clear user consent or controls.
Review this skill before installing if you do not want a local MEMORY.md profile containing birth year, sex, residence details, and derived feng shui classifications. Use it only where cross-session profile storage and possible reuse of fortune-hub memory are acceptable, or modify it to require explicit consent and confirmation before reading or writing memory.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:59- Finding
Unvalidated Cross-Skill Memory Import Enables Persistent Profile Poisoning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill says it has no external API dependency, which is not itself a security problem, but the documentation also instructs reading and writing persistent MEMORY.md files containing user data. That creates local data access and retention behavior that materially affects privacy and trust expectations, so the claim is misleading and can cause operators or users to underestimate data handling risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill directs collection and persistence of personal profile data such as birth year, sex, housing orientation, floor, and move-in time without any consent step or warning. Even if not highly regulated on its own, this is personal and inferential data, and silent storage increases privacy risk and the chance of secondary misuse.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill establishes persistent cross-session collection and reuse of personal data in MEMORY.md without defining retention limits, deletion behavior, or minimization boundaries. This increases the attack surface for accidental disclosure, unauthorized reuse, and privacy harm because the agent is instructed to automatically reuse prior data.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to read from fortune-hub/MEMORY.md in another skill context to supplement missing user profile fields. This is cross-skill data harvesting beyond the immediate fengshui function, and it risks pulling unrelated or previously collected personal data without user awareness or necessity.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The structured writeback includes both raw personal attributes and derived inferences such as 本命卦, 东西四命, and full analysis cache. Storing derived profile classifications increases sensitivity because it preserves not just inputs but interpretive conclusions that can be reused or misapplied later.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to keep MEMORY.md updated when the user changes information or moves homes creates an ongoing profile maintenance mechanism. Continuous profile enrichment over time makes the dataset more complete and therefore more sensitive, increasing harm if exposed or reused outside the user's expectations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Caching the full derived analysis for future consultations preserves a detailed inferential profile that is broader than what is needed for many later interactions. In the context of a fortune/fengshui skill, this is more dangerous because the stored content mixes personal traits, household details, and subjective classifications that users may not expect to persist.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains all user-facing instructional content in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. The stated policy flags language or locale constraints when a specific language is effectively forced without opt-in.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
At L137 and L169, the notes explicitly state that values in the displayed tables are incorrect ('上表有误'), yet the file itself is the calculation-rules reference being presented for use. This is an active contradiction between the document's tabulated rules and its inline notes, creating intent-code/documentation divergence within the skill's declared deterministic rule base.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file is entirely authored in Chinese and the skill metadata indicates Chinese-only trigger phrases and output style, with no documented locale restriction or fallback behavior. While this is not a classic security flaw, it is a genuine policy/compliance issue because users may be steered into a language they cannot understand, which can reduce informed consent and safe use of advisory content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill content is written to operate in Chinese and prescribes a default response style without offering a language choice or documenting a justified locale restriction. This can violate language/locale policy when users have not explicitly opted into Chinese-only interaction.
- Content