UserContext

• Outcome: Review
• Latest audit: Sep 23, 2026 · 3:04 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent daily-context purpose, but it broadly reads private communications and calendars, writes persistent memory, includes account-specific calendar fallback, and ships a plaintext personal schedule sample.

Install only in a private, controlled Hermes profile after removing the packaged new_context.md sample, replacing hardcoded accounts/calendars/paths, backing up USER.md, and configuring an explicit source allowlist. Be aware that enabling the cron lets the skill read reachable private communications and calendars and write a recurring summary into memory used by future sessions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: new_context.md:10
• Finding: Plaintext Disclosure of Sensitive Personal Calendar Data## Vulnerability Details **File Location**: `new_context.md`, lines 10-26 **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: Medium ### Vulnerable Content ```markdown ### Yesterday (2026-09-02) - Island Coatings Quote, 12:30 - Breakfast at leahi health, 13:15 - Reservation at Hau Tree, 13:30 - HNL flight to SFO, 16:20 ### Today (2026-09-03) - Cleaners Arrive, 09:30 - Jon Collins meeting, 11:00, Microsoft Teams - EDD RESEA Virtual Appointment, 15:00 - Reservation at Firefly Restaurant, 17:30 ### Tomorrow (2026-09-04) - DEXA scan at BodySpec San Francisco, 09:57 - Zoom with Jared and Brandon Edwards, 12:00 - Derm Botox, 16:15 - Dinner with Evan, Alex, Michael, Kathy, 18:00 ``` ### Technical Analysis The project includes what appears to be a generated daily-context artifact containing specific travel, employment, medical, meeting, and social schedule details. Because this file is part of the distributable project, every person or system receiving the project can read the information without authentication or calendar-account access. This crosses the trust boundary between the calendar owner's private data and project recipients. The exposure occurs merely through project distribution; executing the Skill is unnecessary. ### Attack Path 1. The project publisher includes `new_context.md` in the Skill package or repository. 2. An unauthorized recipient downloads, clones, or otherwise obtains the project. 3. The recipient opens the plaintext Markdown file. 4. The recipient extracts dates, times, locations, travel plans, medical appointments, and participant names. 5. The information may then be used for profiling, targeted phishing, social engineering, or physical-security planning. ### Impact Assessment The exposed scope includes: - Flight timing and destination information. - Medical and cosmetic appointment details. - Employment-related appointment information. - Meeting platforms and participant identities. - Restaurant reservati ...[truncated 303 chars]
• Remediation: ## Remediation Suggestions 1. Remove `new_context.md` from the distributed project. 2. Purge the file from repository history and assess whether published package versions or mirrors require takedown. 3. Replace operational examples with clearly synthetic names, dates, locations, and events. 4. Add generated context artifacts such as `new_context.md` to `.gitignore` and packaging exclusion rules. 5. Store generated daily context only in the intended private profile location rather than the Skill source tree. 6. Add pre-commit and release checks that detect calendar exports, medical terms, personal email addresses, participant names, and other private snapshot data. 7. Review access logs and distribution history to determine who may already have received the exposed information.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill declares a broad, evidence-grounded USER.md refresh workflow, but the referenced behavior indicates it may actually act as a narrow calendar-access utility while still encouraging persistent profile updates and privileged data access. Description-behavior mismatch is dangerous because operators may grant trust or run the skill under false assumptions, leading to unintended collection from personal systems or incomplete, misleading updates to a file loaded into every session.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The file instructs the agent to use every reachable source and states there is no opt-in or access-seeking step, while examples include highly sensitive personal messaging channels and email. Even though the output is summarized, the collection behavior itself is privacy-invasive and lacks a clear warning or consent boundary for reading intimate cross-channel communications.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly directs the agent to inspect personal communications, session history, and other interaction sources to infer mood and write a compressed personal-state summary into USER.md, which is loaded into every session. This materially increases privacy risk because highly sensitive cross-channel data is being aggregated, interpreted, and persisted beyond the original context, creating opportunities for overcollection, misinference, and broad downstream exposure.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill instructs modification or creation of a persistent personal context file, but the warning is operational rather than a clear user-facing consent notice about writing inferred personal state into a file reused across all sessions. This creates a privacy and integrity risk because sensitive summaries can persist, propagate broadly, and influence later agent behavior without the owner's explicit acknowledgment.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The workflow instructs broad collection from all reachable sources, including messaging and email, to build a cross-channel signal ledger about the user's activities and affective state. Even with instructions not to paste raw messages, the mandated aggregation and persistence of inferred personal context is dangerous because it normalizes overbroad surveillance and can expose intimate behavioral patterns to every later session that loads USER.md.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This reference explicitly documents fallback access to the operator's Google Calendar and recent Gmail outcomes through an agent account, but it does not pair that capability with any explicit privacy guardrails, consent checks, or user-facing warning. In a skill whose purpose is to infer mood, location, and daily status from sensitive personal signals, normalizing silent cross-account access increases the chance of over-collection or use of highly sensitive data beyond the user's immediate awareness.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly states that any newly added source will be classified at runtime and used automatically, without requiring any skill change or narrower allowlist. In the context of a skill that reads personal communications and other sensitive signals, this creates scope creep: future connectors may silently expand collection to more invasive data sources than the user reasonably expects.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script explicitly falls back from the owner's account to a second person's Google account, even though the skill's stated purpose is to maintain the owner's daily context. That creates an unjustified cross-account data access path and can expose another person's calendar contents, locations, and schedule metadata to a workflow that is not scoped to them.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill retrieves personal calendar data from external Google accounts without any evident disclosure, consent check, or user-visible indication at the point of access. In a skill that synthesizes sensitive daily context such as mood, location, and schedule, silent collection increases privacy risk and makes over-collection harder for the user to detect or contest.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The file instructs the skill to always resolve and use the host timezone for date calculations, with no option for the user to choose a different locale or timezone. This is a locale policy concern because it hardcodes one temporal locale behavior rather than offering opt-in or configuration.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: This markdown file contains user-context content but does not specify any activation conditions, trigger phrases, or exclusion criteria for when a related skill should be invoked. For markdown files, the absence of trigger specificity can lead to ambiguous or overly broad activation if this document is used as part of a skill description or context source.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: This markdown file instructs the installer to create and later update `<profile>/memories/USER.md`, which affects persistent user data. While the document describes the target file and later verification steps, it does not clearly warn that the skill will modify that file as part of normal operation.

Static analysis

No suspicious patterns detected.