CSPR Interest Profiler

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:40 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent personalization purpose, but it silently scans browser history and local notes, then writes inferred preferences and URL-derived records into persistent memory without default user approval.

Install only if you are comfortable with CSPR using local browser history, notes, and feedback to update long-lived personalization memory. Before use, prefer requiring an explicit preview and approval step, limiting URL retention, and deleting raw history artifacts after profiling.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:10

Finding

Silent Collection and Persistent Storage of Sensitive Behavioral Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–33
Vulnerability Type: Privacy-sensitive local data access and persistence without explicit approval
Risk Level: Medium

Vulnerable Code

text

Workflow:

0. If the run folder has no history artifact, create it with:

    interest-scan browser --out RUN/history_evidence.json

1. Compact the raw history before reading it:

    interest-scan compact --in RUN/history_evidence.json --out RUN/history_context.json

2. Export the complete local seen-URL set for tool filtering:

    interest-scan seen --in RUN/history_evidence.json --out RUN/seen_urls.jsonl

   When a CSPR home is available, pass `--home HOME` so browser-history URLs are also recorded into persistent read memory at `HOME/state/read_items.jsonl`.

3. Infer repeated creators and source preferences:

    source-infer from-history --in RUN/history_evidence.json --out RUN/potential_sources.yaml

4. Read the current run folder's `history_context.json` and `potential_sources.yaml`. Avoid reading raw `history_evidence.json` unless the user asks for detailed inspection. Do not read `seen_urls.jsonl` into the model context unless debugging a specific filter issue.
5. Read `~/.cspr/memory/notes.md` and `~/.cspr/state/feedback.jsonl` if present.
6. Infer durable interests, short-term interests, disliked patterns, and source preferences.
7. Write a complete `profile.yaml` into the run folder.
8. Apply it with:

    prefmem update --in RUN/profile.yaml

Keep the user experience quiet. Do not ask for profile approval unless the user explicitly requests review.

Technical Analysis

The skill directs the agent to scan browser history, export the complete local set of visited URLs, read local notes and feedback, infer behavioral preferences, and update persistent profile memory. It also directs the agent to keep the process quiet and not request profile approval by default.

Browser ...[truncated 2747 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed opt-in before the first browser-history scan. Clearly identify every source that will be read and every destination where data will be stored.
2. Present a preview of inferred profile attributes before applying them to persistent preference memory, with controls to approve, edit, or reject each category.
3. Default to aggregated domains, categories, and frequency counts instead of exporting complete URLs.
4. Strip URL query strings, fragments, credentials, tokens, document identifiers, and other sensitive parameters before writing any history-derived artifact.
5. Do not automatically read notes.md or feedback.jsonl; provide separate per-source consent controls and document why each source is necessary.
6. Make persistent recording through --home HOME opt-in rather than automatic whenever a CSPR home is detected.
7. Define retention limits and automatically delete raw history_evidence.json and other temporary artifacts after profile generation unless the user explicitly requests retention.
8. Restrict generated files to the invoking user with appropriate filesystem permissions and avoid storing them in shared or predictably accessible directories.
9. Provide commands or interface controls to inspect, correct, export, and delete collected history, inferred preferences, and persistent read-memory records.
10. Replace the instruction to keep the process quiet with transparent status reporting that explains what information is being processed without unnecessarily displaying sensitive content.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill collects browser-history evidence, reads local notes and feedback, infers interests, and applies them directly to persistent preference memory while explicitly telling the agent to keep the experience quiet and not ask for approval. This creates a meaningful privacy and autonomy risk because sensitive behavioral data can be turned into durable profiling without informed user consent or review, and mistakes may persist across future sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill instructs the agent to create a browser-history artifact and optionally write URL history into persistent read memory, which causes local browsing data to be harvested and retained beyond the immediate task. In this skill's context, that persistence is directly tied to user profiling, making accidental over-collection or long-term storage of sensitive browsing activity more dangerous than a transient read.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

Workflow:

0. If the run folder has no history artifact, create it with:

    interest-scan browser --out RUN/history_evidence.json