Look

• Outcome: Review
• Latest audit: May 28, 2026 · 7:56 AM UTC
• Version: 2.3.0

Overview

The skill has a coherent image-to-action purpose, but it automatically installs a daily self-update job that can replace its own code from GitHub without explicit per-update approval or integrity checks.

Install only if you are comfortable with a skill that processes potentially sensitive images, writes journals and extracted entity signals, and registers a daily background self-update. Prefer disabling or removing the cron update, using manual reviewed updates pinned to trusted releases, and confirming all ledger, drive, purchase, health, civic, calendar, and maps actions before execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The README claims there are no external dependencies while also describing web research via Sift and scheduled self-updates from GitHub, which materially understates the skill's external trust boundaries and network exposure. This can mislead operators into deploying the skill without evaluating supply-chain, connectivity, and update-channel risks.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill auto-registers a cron job that pulls updates from GitHub, but the README does not clearly warn that this changes executable behavior over time and introduces supply-chain risk. Automatic code retrieval and replacement can allow compromise of the running environment if the upstream repository, release channel, or update path is tampered with.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README says extracted entities from user-provided images are emitted to Chronicle and Elephas without an explicit privacy or data-sharing warning. Because images may contain sensitive personal, financial, or location data, silent propagation of derived entities increases the risk of unintended disclosure and retention across systems.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger phrases include very broad, everyday language such as 'what is this' and 'look at this image', which can cause unintended invocation and route user content into a powerful image-to-action workflow. In this skill context, accidental activation is more dangerous because the skill performs external research, drafts action proposals, writes files, and can later execute confirmed actions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The self-update flow performs silent code replacement from a remote GitHub source with minimal user visibility, which creates a supply-chain risk and removes an opportunity for human review. In this skill, the risk is elevated because the updated code can change future behavior, scheduled cron execution, data handling, and external actions without explicit per-update approval.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The Products playbook describes broad behaviors like identifying products from barcode/OCR and fetching offers, but it does not define clear user-intent or activation boundaries. In an agent setting, this can cause the skill to trigger on loosely related images or messages and initiate commerce-oriented flows without sufficient confirmation, increasing the risk of unintended data use or purchasing recommendations.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The Documents section is generic enough to match many ordinary document-related interactions, yet it includes side effects like OCR, PDF generation, and drive-folder proposals. Without tighter activation constraints, the agent may process sensitive files too readily or suggest storage actions the user did not clearly request.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The Receipts playbook states that financial details will be extracted and routed to a ledger per configuration, but it does not warn the user that sensitive transaction data may be sent into downstream accounting storage. This creates a transparency and privacy risk, especially if users expect passive OCR rather than persistence or automated bookkeeping.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The Documents playbook omits notice that the skill may generate a searchable PDF and propose cloud-drive storage locations, both of which are meaningful side effects involving potentially sensitive content. In document workflows, silent file generation and storage suggestions can lead to accidental retention, oversharing, or movement of confidential records.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill advertises broad trigger phrases such as 'look at this image', 'what is this', and 'update look', which overlap heavily with normal user speech and can cause the skill to activate unintentionally. In a multimodal assistant, this increases the chance of misrouting user requests and exposing user-provided images or downstream actions to the wrong skill context without explicit intent.

Self-Modification

High

• Category: Rogue Agent

Content

## Setup

`look.init` runs automatically on first invocation and creates all required directories, config.json, state.json, and JSONL files. No manual setup is required. It also registers the `look:update` cron job (midnight daily) for automatic self-updates.

## Dependencies

• Confidence: 99% confidence
• Finding: Registering an automatic self-update cron job on first invocation is a self-modifying behavior that changes the codebase without per-update review. In an agent skill context, this is especially dangerous because future behavior can drift beyond what was initially audited, and any compromise of the update source can lead to persistent code execution.

Self-Modification

High

• Category: Rogue Agent

Content

| Job | Mechanism | Schedule | Command |
|---|---|---|---|
| `look:update` | cron | `0 0 * * *` (midnight daily) | Self-update from GitHub source |

## Changelog

• Confidence: 99% confidence
• Finding: A scheduled cron-based self-update from GitHub creates recurring unattended code modification, expanding the attack surface from local code to the entire upstream delivery pipeline. Because the action is periodic and automated, exploitation can become persistent and widespread before users notice changes.

Self-Modification

High

• Category: Rogue Agent

Content

## Changelog

### v2.3.0 -- March 27, 2026
- Added `look.update` command and midnight cron for automatic version-checked self-updates

### v2.2.0 -- March 22, 2026
- Routing improvements

• Confidence: 97% confidence
• Finding: The changelog confirms that automatic version-checked self-updates were intentionally added, reinforcing that self-modification is a designed capability rather than an incidental mention. That makes the risk more credible in context: this skill is meant to evolve code in place, which is unsafe without strong integrity controls and explicit operator consent.

Static analysis

No suspicious patterns detected.