Security audit

Ken Idea Capture

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed but high-risk always-on idea logger that silently stores user messages and can forward captured content to Feishu and Telegram.

Install only if you deliberately want an always-on, silent idea-capture workflow. Confirm the inbox path and Feishu/Telegram destinations first, avoid using it in chats involving secrets or personal data, and require a way to review, delete, and disable captured entries before forwarding them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill defines silent capture behavior but also includes an activation flow that announces configuration and asks for confirmation, creating inconsistent privacy expectations and ambiguous consent boundaries. This mismatch is dangerous because users may think they are only confirming configuration while the skill still enables broad silent logging during normal conversation.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill presents itself as an inbox capture tool, but it also schedules review delivery to Telegram and Feishu, materially expanding data flows beyond the stated purpose. This is risky because users may not understand that captured content will be retransmitted to multiple external channels, increasing exposure and consent/compliance issues.

Vague Triggers

High

Confidence: 98% confidence
Finding: The trigger is effectively always-on and applies across any conversation, causing continuous monitoring of user messages for capture candidates. In this context, that broad scope makes overcollection likely and turns ordinary conversation into passive surveillance without clear boundaries.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill explicitly instructs silent writing of user content without notifying the user at the time of capture. Covert collection is dangerous because it removes informed consent, hides retention from the user, and makes accidental capture of sensitive information much more likely.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The implementation requires automatically appending user content to storage before replying, with no confirmation or visible disclosure. This operationalizes hidden persistence on every interaction and can capture sensitive data incidentally, especially given the broad capture rules.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill is designed for broad, ongoing collection of user statements and subsequent handling across conversations and review channels. In context, this creates a covert data-retention pipeline that can accumulate sensitive personal or business information far beyond what users expect from casual chat.

Ssd 3

High

Confidence: 99% confidence
Finding: Preserving the user's original words and silently recording them creates an undisclosed transcript-like store of potentially sensitive content. This is dangerous because verbatim retention increases privacy harm, legal/compliance exposure, and the impact of any downstream leak or misuse.

Ssd 3

High

Confidence: 98% confidence
Finding: The scheduled daily/weekly reviews send captured content to Telegram and Feishu, expanding distribution to external systems and increasing the chance of unauthorized disclosure. Additional channels also multiply trust dependencies, access-control concerns, and compliance obligations.

Ssd 3

High

Confidence: 99% confidence
Finding: The implementation mandates checking every user message and appending retained content without asking, which amounts to continuous covert collection. In this skill context, that behavior is especially dangerous because the capture criteria are intentionally broad and include complaints, wishes, and casual ideas that may contain sensitive context.

Static analysis

No suspicious patterns detected.