Security audit

Personal Friends

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it persistently stores sensitive information about friends and debts with broad activation and little user control.

Review before installing. Use this only if you are comfortable storing friends' birthdays, relationship notes, meeting plans, gift ideas, and debts in a local workspace file. Consider narrowing when the skill activates and requiring confirmation before it saves or changes sensitive personal or financial details.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README explicitly states that the skill stores friends' profiles, birthdays, meeting plans, gift ideas, and debts in a workspace file, which is sensitive personal and financial data. There is no warning about privacy, consent, retention, access controls, or the risk of storing third-party data, making accidental overcollection or inappropriate disclosure more likely in normal use.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The activation triggers are broad enough to match ordinary conversation about friends, meetings, birthdays, or debts, which can cause the skill to activate outside a clearly intended context. In this skill, that matters because activation grants access to and potential updating of a private social-memory file, increasing the chance of unintended handling of sensitive personal data.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The skill's operational instructions are written entirely in Russian and specify tone and behavior in Russian without indicating that this language choice is optional or region-specific. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly instructs the assistant to remember and update private social information, including birthdays, debts, and relationship notes, without requiring a contemporaneous user warning or consent before persistence. This creates a meaningful privacy risk because sensitive data about both the user and third parties may be stored automatically from casual conversation.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: The natural-language instructions and command examples are presented only in Russian, which can amount to forcing a specific language without offering the user a choice. The file does not document that the skill is intentionally Russian-only or provide an opt-in or alternative locale.

Static analysis

No suspicious patterns detected.