People Relationship Map

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:41 AM UTC
• Version: 0.1.0

Overview

This is a coherent personal CRM skill, but it can silently store personal relationship details and recommends sending relationship digests to messaging channels without enough consent and privacy guardrails.

Review this before installing if you plan to store sensitive social, family, medical, workplace, or private relationship details. Use explicit commands for writes, avoid enabling the weekly messaging digest unless you understand what will be sent, and treat the generated people directory as plaintext personal data that may need deletion, backup, or access controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The feature list advertises 'Auto-capture' of people mentions and persistent storage in Markdown and JSON, but it does not clearly warn users that personal relationship data may be automatically extracted from conversations and stored long-term. Because this is a personal CRM containing identity, affiliation, relationship, and interaction history data, omission of a prominent privacy notice materially increases the risk of surprise collection, over-retention, and exposure of sensitive personal information.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The auto-capture behavior tells the agent to silently persist user-provided personal and relational information when intent seems clear. Silent collection and storage of third-party personal data is dangerous because it bypasses explicit confirmation, can capture sensitive facts about others, and may create a durable record the user did not realize was being written.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The weekly digest feature proposes sending relationship-staleness summaries over WhatsApp or Telegram without warning that personal relationship data will leave local storage and be transmitted through third-party messaging services. This raises confidentiality and metadata exposure risks, especially because digests may reveal who the user knows, contact frequency, and relational context.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README encourages very broad, natural-language use such as 'just talk to your agent naturally' followed by examples that include adding people, linking relationships, and logging interactions. In a skill that persistently stores personal relationship data and supports auto-capture, this can lead to unintended invocation or accidental recording of sensitive personal information when the user did not mean to update the CRM.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill directs use of a Python script that reads and writes local relationship data, but the manifest does not declare any tool scope or permissions. That mismatch weakens least-privilege controls and makes it harder for a host system or user to understand that the skill can access and persist sensitive personal information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill stores names, relationship notes, contact history, and other personal details on disk, yet the description does not warn users that sensitive personal data will be persisted locally. In a personal CRM context, omission of a privacy notice increases the chance users disclose more information than intended without understanding retention and exposure risks.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill's stated purpose is local relationship mapping in Markdown and JSON, but it also instructs delivery of weekly digests to WhatsApp or Telegram. That expands the data flow to external channels without clearly defining the integration boundary, consent model, or security guarantees, creating a risk of unintended disclosure of sensitive relationship data.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes broad natural-language phrases like 'who do I know', 'add person', 'tell me about person', and 'meeting prep' that are likely to appear in ordinary conversation. This can cause unintended invocation of the skill, leading to accidental storage, retrieval, or linking of sensitive relationship data in a personal CRM context.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This skill stores sensitive personal relationship data, notes, organizational affiliations, and contact history in plaintext Markdown and JSON on disk without any visible warning, consent flow, or privacy guardrails. In a personal CRM context, persistent storage is intrinsic to the feature set, which makes the issue more dangerous because users may input highly sensitive social and professional intelligence without realizing how broadly readable or long-lived it is.

Tainted flow: 'GRAPH_FILE' from os.environ.get (line 31, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

def save_graph(graph: dict):
    ensure_dirs()
    with open(GRAPH_FILE, "w", encoding="utf-8") as f:
        json.dump(graph, f, indent=2, ensure_ascii=False)

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Static analysis

No suspicious patterns detected.