T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:69- Finding
Unnecessary Cross-Skill Access and Persistent Storage of Personal Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Vedic Astrology
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Vedic astrology skill, but it should be reviewed because it silently reuses and stores identifying birth-profile data.
Review this before installing if you do not want an agent to save or silently reuse birth details. The main risk is local privacy and cross-skill profile sharing, not malware: the skill should ideally ask before reading fortune-hub memory or writing MEMORY.md, show the values it plans to use, and provide a clear way to skip, correct, or delete stored data.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (11)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to persist highly identifying birth data and derived chart information without a clear upfront notice that the information will be stored for future reuse. This undermines informed consent and creates substantial privacy risk because exact birth date, time, and place are sensitive personal attributes that can persist beyond the immediate task.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Using the single trigger term 'Vedic' is overly broad and can activate the skill in unrelated contexts, causing unintended handling of user messages and potentially prompting unnecessary collection of birth data. Overbroad invocation increases the chance that sensitive workflows run without clear user intent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest frames the skill as pure reasoning without external dependencies, which suggests a self-contained interpretive capability. However, the documented workflow explicitly reads from MEMORY.md and writes user birth data and chart cache back to disk, introducing stateful storage behavior beyond pure LLM reasoning.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The top-level documentation describes the skill as pure LLM reasoning, which implies no auxiliary data-loading or persistence behavior. Later sections instruct the agent to load reference documents and persist user data/results in MEMORY.md, contradicting that characterization rather than merely omitting detail.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs collection and storage of sensitive personal data, including date of birth, birth time, birthplace, and timezone, in persistent memory. That exceeds what is strictly necessary for a one-time reading and creates privacy risk if the data is later accessed, repurposed, or exposed to other skills or sessions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to read stored birth details and reuse them 'without asking again' removes an important consent and context check for sensitive data. Reuse across sessions or tasks can surprise users, cause privacy boundary violations, and propagate stale or incorrect identity data into later interactions.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The phrase 'use it directly without asking again' authorizes autonomous reuse of sensitive personal data without a fresh user decision. In this skill's context, that means the agent can act on intimate identifying information and derived profile fields without contemporaneous confirmation, increasing privacy and consent risk.
- Content
md 1. This directory's `MEMORY.md` — use first 2. `fortune-hub/MEMORY.md` in the same repo (if it exists) — fill in any missing base profile fields If data is available, use it directly without asking again. **Writing**: After collecting user info, write it to **this directory's** `MEMORY.md`:
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Caching a detailed personal profile and derived chart data creates a persistent dossier that goes beyond transient task execution. Even if intended for convenience, this enlarges the blast radius of any memory exposure and enables future inference about the user's identity, habits, or beliefs.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Telling the agent to cache full reading results for future queries preserves not just raw birth details but also derived personal interpretations. Persistent storage of these outputs can expose sensitive inferences and makes later misuse or unintended disclosure more damaging.
- Content
YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]
Medium
- Category
- YARA Match
- Confidence
- 65% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md ore Quality (1–2 sentences) | |---|-----------|---------|------------------------------| | 1 | Ashwini | Healing, speed, new beginnings | Bursting with the vitality of a swift horse, Ashwini natives are natural healers and pioneers — quick to act, though patience may need cultivating. | | 2 | Bharani | Transformation, responsibility, creativity | Carrying souls between worlds, Bharani holds a fierce sense of responsibility and creative drive — capable of breaking through at the edges, with emotions that run deep and hot. | | 3 | Krittika | Sharpness, purification, precision | Burning like a flame, Krittika is razor-sharp and pure — driven by keen discernment and critical thinking, pursuing excellence without compromise. | | 4 | Rohini | Prosperity, beauty, nourishment | Considered one of the most auspicious of all Nakshatras, Rohini radiates material abundance and sensory beauty — emotionally warm, with an instinctive attunement to loveliness in all its forms. | | 5 | Mrigash
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The statement 'This Skill uses the Lahiri system by default' imposes a specific astrological system in natural language without indicating that users can choose alternatives, even though multiple systems are presented above. This can be a locale/method policy concern because it defaults users into one convention without explicit opt-in or selection.
- Content