Security audit

Family Memory Timeline

Security checks for vulnerabilities and agentic risk

Overview

This skill locally formats supplied family-memory text and media path metadata into timelines, with privacy and Markdown-rendering cautions but no evidence of hidden access, exfiltration, persistence, or destructive behavior.

Install only if you are comfortable giving the skill family conversation text and media path metadata. Avoid publishing generated Markdown without review, and render it with HTML disabled or sanitization enabled because user-provided text is inserted verbatim. Expect Chinese-first output unless localization controls are improved.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

Location: handler.mjs:185
Finding: Unescaped User-Controlled Project Name in Markdown Output
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly processes highly sensitive family photos, videos, and conversations, including examples with local filesystem paths and intimate personal events, yet provides no privacy notice, retention policy, consent guidance, or data-handling limitations. This increases the risk of users exposing personal or child-related data without understanding how it is stored, processed, or shared.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The handler stores raw conversation content in timeline objects and reproduces it in markdown output without minimization, redaction, or consent controls. Because this skill is explicitly designed to process family memories, the data is likely highly personal, so systematic retention and re-display of conversations increases privacy leakage risk if outputs are shared, logged, or exposed to unintended recipients.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill generates titles, labels, and narrative text entirely in Chinese, including the timeline title, section headings, and default story text. Because there is no visible mechanism for language selection or explicit documentation that this is a region-specific skill, this creates a language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The markdown renderer hard-codes toLocaleString('zh-CN') and toLocaleDateString('zh-CN'), which forces a specific locale for generated output. This is a natural-language/locale policy concern because the skill does not offer user opt-in or configuration for language/locale selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Markdown output hard-codes the locale 'zh-CN' for date/time formatting, which enforces a specific language/locale regardless of user preference. This is a natural-language policy issue because the skill does not offer any locale selection or document a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Multiple output lines use toLocaleDateString('zh-CN'), causing rendered content to always follow Chinese locale conventions. Because no user choice or explicit documented limitation is present in this file, the behavior violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The document states that both Chinese and English are supported, but the instructions, trigger phrases, and examples are effectively only in Chinese. This can amount to an implicit language constraint without an explicit user opt-in or bilingual interaction guidance.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The documentation explicitly states '不接入真实第三方API，使用模拟数据' and '无外部依赖（纯模拟实现）'. However, only a markdown description is provided here and no handler.mjs or other code is present, so this intent cannot be verified against actual implementation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file comments are written only in Chinese ('主处理器', '负责接收请求...'), which indicates a language-specific presentation without any indication that users or maintainers can opt into another language. Under the policy, forced language choice without user opt-in can be a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The language field only permits zh, en, or auto, which encodes a narrow language policy in a user-facing configuration type. This can be a natural-language policy concern because it limits locale/language support without indicating that the restriction is optional, user-consented, or region-justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The code comments and helper names indicate the skill converts stories to Markdown or JSON, and lines L409-L416 build outputContent accordingly. However, the returned object at L418-L425 contains only the raw story object and processing metadata, so the selected formatted output is discarded and not exposed to callers.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The description is written in Chinese while the manifest also declares both English and Chinese in the language field. This may imply bilingual or locale-specific behavior without clearly stating how the user's preferred language is selected, which can conflict with language-choice policy if the skill defaults to one language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code file contains user-facing console messages and test data entirely in Chinese, including status output and labels. That can violate a language/locale policy when a skill forces a specific language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.