Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed self-exploration and writing workflow, but it can turn sensitive personal disclosures into reports and first-person public-style articles without fresh user confirmation, even after a stop request.
Install only if you are comfortable with a skill that asks reflective personal questions and may produce analysis and first-person article drafts from your answers. Before using it, confirm that the agent should ask before generating any report, ask separately before writing a public-style article, avoid inferring gender or age, and treat any request to stop as stopping all further processing unless you explicitly ask for a summary.
The skill description advertises a workflow that includes public-facing content creation and later references image-generation behavior not present in the declared tool allowlist. Undeclared capabilities undermine policy enforcement and make it harder to reason about what actions the agent may take with user-provided personal material.
The skill instructs automatic generation of an analysis report and first-person article without waiting for user confirmation. That is dangerous because it converts sensitive disclosures into durable derivative content, potentially including intimate inferences, without an informed opt-in at the moment of generation.
Automatically turning user disclosures into a report and first-person article is a sensitive-data transformation risk, especially because the article is styled as if written by the user. In this context, the output could expose intimate details, create reputational harm, or be reused as seemingly authentic self-authored content without explicit consent.
Requiring collection or inference of name, gender, and age for '画像' generation without sufficient notice or opt-out creates profiling risk beyond what is necessary for a reflective conversation. The mandatory nature of this instruction makes it more dangerous because the user may believe these attributes are required to continue.
The skill explicitly tells the model to transform full conversation material and style cues into a first-person article that sounds like the user wrote it. That increases impersonation and privacy risks because it can create convincing personal narratives from sensitive disclosures, suitable for public posting or redistribution.
The test case says that even if a user says 'stop,' the skill should still generate an analysis report based on prior disclosures. This overrides the user's attempt to halt processing and extends use of sensitive data after consent has effectively been withdrawn for the session.
Continuing to generate reports and articles after the user has asked to stop is a serious consent violation. It is especially risky here because the derivative outputs may crystallize vulnerable disclosures into shareable, first-person content after the user tried to end the interaction.
The implicit trigger conditions are broad enough to match ordinary expressions of confusion or desire for advice, so the skill may activate when the user did not intend a deep self-analysis workflow. In this context, misfire matters because the skill collects sensitive autobiographical material and produces derivative outputs from it.
The keyword list includes common phrases that can appear in many non-sensitive conversations, increasing the chance of accidental activation. Because this skill moves from casual dialogue into analysis and content generation, coarse trigger granularity increases privacy and consent risk.
The skill asks for or infers gender and age range for persona construction without clearly explaining necessity, use, retention, or alternatives. These are personal attributes, and inferring them from conversation increases privacy risk and the chance of incorrect or sensitive profiling.
The skill directs the model to collect or infer profile attributes for persona generation, which is a form of user profiling. In a self-exploration setting, that context makes the data especially sensitive because the conversation is likely to include personal history, relationships, and emotional vulnerabilities.
The skill declares only Read/Write/Edit/AskUserQuestion as allowed tools, but later instructs use of image generation for cover art. This creates a capability mismatch between the manifest and the documented behavior, which can lead to undeclared tool use or unsafe fallback behavior that operators and users did not consent to.
No suspicious patterns detected.
