Security audit

Inbox Capture Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill openly works as an automatic idea logger, but it silently monitors broad conversations and persistently stores users' original words.

Install only if you intentionally want broad, background idea capture. Configure a narrow inbox destination, avoid external sync for private or work chats unless all participants have agreed, and make sure you have a way to pause capture and review, edit, or delete stored entries.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

High

Confidence: 98% confidence
Finding: The skill is configured as effectively always-on and applies to 'any conversation', causing the agent to evaluate and potentially persist broad swaths of user speech without a narrow trigger boundary. In context, this materially increases the chance of collecting sensitive, irrelevant, or unintended content during ordinary interaction.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill description explicitly says ideas are written automatically without asking for confirmation, which enables background persistence of user content with no just-in-time notice. This is dangerous because users may reveal personal, confidential, or regulated information in normal conversation without realizing it is being stored.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The post-capture instructions mandate silent writing and specifically prohibit notifying the user that data was recorded. That combination removes transparency and informed consent, making unnoticed retention of sensitive statements far more likely.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill directs the agent to silently log broad categories of user conversation and preserve original wording across general dialogue, without per-item consent. In this context, verbatim persistent logging can capture secrets, personal data, credentials, or sensitive business information that the user never intended to store.

Ssd 3

High

Confidence: 99% confidence
Finding: These instructions combine verbatim recording, silent persistence, and an explicit directive not to inform the user after capture. That pattern is especially risky because it creates covert behavioral logging rather than transparent note-taking, increasing privacy, compliance, and trust harms.

Ssd 3

High

Confidence: 98% confidence
Finding: The implementation requires inspecting every user message before responding and appending qualifying content to persistent storage, turning routine conversation into a surveillance-like collection pipeline. Because this occurs pre-response and by default, the surrounding context makes accidental overcollection and privacy leakage more likely, not less.

Static analysis

No suspicious patterns detected.