Security audit

Genealogy Agent

Security checks for vulnerabilities and agentic risk

Overview

This genealogy skill is purpose-aligned, but it needs review because it handles sensitive family data through external services and shell-style tool commands with weak scoping.

Review before installing. Use this only in a contained environment, avoid entering details about living or sensitive relatives unless you accept third-party LLM/search exposure, choose output paths carefully, and prefer pinned dependencies plus argument-safe tool execution before trusting it with important family records.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: skill.json:10
Finding: Shell Command Injection Through Unescaped Tool Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/research.py:67
Finding: Indirect Prompt Injection Through Untrusted Search Results
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_obsidian.py:60
Finding: Format Injection in Generated Obsidian, Mermaid, and GEDCOM Files
Content: View full analysis
({birth} - {death})" mermaid_lines.append(f' {node_id}["{label}"]') for rel in data.get("relationships", []): source = rel["source_id"] target = rel["target_id"] rel_type = rel["type"] if rel_type == "parent": mermaid_lines.append(f' {source} -->|parent| {target}') ``` From `scripts/export_gedcom.py`: ```python name_parts = person["name"].split(" ", 1) first_name = name_parts[0] last_name = f"/{name_parts[1]}/" if len(name_parts) > 1 else "" lines.append(f"1 NAME {first_name} {last_name}") if person.get("birth_date"): lines.append(f"2 DATE {person['birth_date']} ...[truncated 2548 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:13
Finding: Unpinned Third-Party Dependencies and Non-Reproducible Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code aligns with the extraction/structuring portion of the description: it defines person/relationship schemas, prompts an LLM to extract family data, and outputs JSON. However, the broader declared description includes several substantial capabilities not present in this code chunk: research, graph/tree visualization, Obsidian vault creation, and GEDCOM export. There are no undeclared risky permissions or unrelated behaviors in the snippet, but the declared purpose materially overstates what this code actually does.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code concatenates untrusted search-result titles and snippets directly into the LLM prompt and asks the model to merge new facts into a JSON record. Retrieved content can contain adversarial instructions or fabricated biographical claims that cause the model to ignore the intended task, output manipulated JSON, or insert false genealogical facts with apparently trustworthy citations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises autonomous web research and generation/export of local artifacts such as Obsidian vaults and GEDCOM files, but it does not warn users that sensitive family-history data may be sent to external services or written to disk. In a genealogy context, the data often includes names, dates, locations, and relationships for living or recently deceased people, so the omission can lead to unintended privacy disclosure and unexpected local side effects.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises capabilities that imply local file reads/writes, but it does not declare any explicit tool scope or permissions boundaries. That makes data access and file modification behavior opaque to users and reviewers, increasing the risk of unintended access to local genealogy data or writing sensitive family information to disk without clear authorization expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill processes highly sensitive family-history data and explicitly mentions use of external LLM providers and web research services, but it does not warn users that names, dates, locations, and relationship data may be transmitted to third parties. This can expose private or regulated personal data about living relatives and create consent, privacy, and data-retention risks.
Content: No source excerpt is available for this finding.

Ssd 2

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: User-controlled narrative text is interpolated directly into the extraction prompt, so embedded instructions in the source material can compete with or override the extraction task. Because the skill relies on model output for structured genealogy data, prompt injection can cause incomplete, manipulated, or fabricated family records, which is particularly harmful in a data-extraction workflow intended to produce authoritative outputs like knowledge graphs and GEDCOM exports.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The function sends raw genealogy narrative text directly to an external LLM provider, which can include highly sensitive personal and family-history data. In this skill context, that increases privacy and compliance risk because users may submit living persons' names, dates, locations, and other personal details without any disclosure, consent flow, or data-minimization step.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The function sends potentially sensitive genealogical data such as names, birth dates, and birth places to external search and LLM providers without any explicit consent flow, warning, or minimization. In a genealogy context this can expose living persons' personal data and family relationships to third parties, creating privacy and compliance risks even if the feature is intended for legitimate research.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest explicitly advertises autonomous web research on ancestor data via DuckDuckGo, but it provides no user-facing disclosure that family-history data may be transmitted to external services. Because genealogy data often contains sensitive personal information about living or recently deceased individuals, silent network use can expose private data outside the local environment and create privacy, compliance, and trust risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill offers Obsidian vault and GEDCOM export generation, which inherently writes structured family data to local files, but it does not warn users about local persistence. In genealogy contexts, these files may contain sensitive personal details and can remain on disk, be synced to cloud storage, or be shared unintentionally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The script switches to Russian/Soviet databases when the name contains Cyrillic characters and otherwise defaults to English-language genealogy sources. This imposes a locale-specific behavior based on inferred language/script rather than an explicit user choice or documented opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.