Security audit

kid-safe-assistant-setup

Security checks for vulnerabilities and agentic risk

Overview

The verdict is suspicious because scanners report concerns about retaining children’s conversations, an unpinned Docker image with write access to application code, and parent-assistant access to raw transcripts.

Review the retention policy, who can access raw conversations, and why the Docker helper needs write access to application code before installing. The skillspector scan was partial: it inspected the one bundled component but could not resolve three local path-like references. AIG reported no findings, but that does not resolve these reported concerns or make the evidence complete.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

The workflow requires indefinite retention of children's conversations without a privacy warning or user-facing retention notice.

Medium

Category: Output Handling
Confidence: 98% confidence
Finding: The explicit instruction to never truncate history creates unbounded retention of children's conversations without a stated deletion policy or retention notice. Children may disclose sensitive information despite the persona rules, so accumulating transcripts increases the consequences of credential theft, server compromise, or unintended household access; a weekly digest does not require indefinite raw-history storage.
Content: No source excerpt is available for this finding.

Docker image referenced without tag or digest: 'docker run --rm'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Although the matched fragment does not identify an image, the complete command uses the unpinned alpine image, implicitly selecting a mutable latest tag. That image receives write access to the application-code volume, so a compromised or unexpectedly changed image could modify the child-facing application and persist changes beyond the helper container's lifetime.
Content: No source excerpt is available for this finding.

The export design grants raw transcript access despite the stated privacy boundary against giving the parent that access.

Medium

Category: Excessive Agency
Confidence: 92% confidence
Finding: The design claims to avoid giving the parent raw transcript access, but provides the parent's full-access assistant with credentials to retrieve raw message text. Token authentication limits callers, but an instruction to summarize rather than quote is not an enforceable privacy boundary; the parent-controlled assistant can access the underlying conversations.
Content: No source excerpt is available for this finding.