Security audit

awesome-closet-stylist

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent wardrobe assistant skill that stores closet and preference data locally and may use weather lookups, with no evidence of hidden exfiltration or unsafe automation.

Install this only if you are comfortable with the skill maintaining a local wardrobe and long-term style preference profile. Review or clear the local user data files when needed, confirm destructive wardrobe changes, and be mindful that weather-aware requests may involve sending a city or location context to an external weather source.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · sub-skills/clothing-notes.md (reported line 116)May include surrounding context.
md
### Destructive or action-implying statements If the statement implies removal, disposal, deletion, or another irreversible action, the agent must not quietly record it as a note in order to sidestep the confirmation boundary. For example, statements like "I should get rid of this" or "This can be thrown away" may trigger wardrobe-mutation implications and must not be reduced to harmless note-taking without considering deletion rules.

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 85% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · sub-skills/wardrobe-crud.md (reported line 169)May include surrounding context.
md
--- ## Consistency and non-overwrite rules This sub-specification only governs wardrobe facts.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.
md
- It must not treat inference as fact. - It must not silently rewrite `fact state`, `persistent preference`, or `item notes` for convenience. - It must not claim that a temporary session signal is now a durable preference unless another module has explicitly handled that write. - It must not bypass confirmation requirements that belong to CRUD, preference persistence, or other state-changing modules. - It must not convert recommendation convenience into unauthorized state mutation. - It must not rely on workflow-style mandatory sequencing when a more natural response is possible within policy boundaries.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · sub-skills/outfit-recommendation.md (reported line 165)May include surrounding context.
md
- It must not treat inference as fact. - It must not silently rewrite `fact state`, `persistent preference`, or `item notes` for convenience. - It must not claim that a temporary session signal is now a durable preference unless another module has explicitly handled that write. - It must not bypass confirmation requirements that belong to CRUD, preference persistence, or other state-changing modules. - It must not convert recommendation convenience into unauthorized state mutation. - It must not rely on workflow-style mandatory sequencing when a more natural response is possible within policy boundaries.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The spec explicitly defines cross-session storage of personal style preferences in user/preference.json but does not require any user-facing disclosure, consent, or reminder that these preferences will persist beyond the current session. In a wardrobe assistant, these preferences can reveal sensitive lifestyle patterns, body-fit information, habits, and personal tastes, so silent retention increases privacy risk and can violate user expectations even if the data is not overtly high-risk authentication material.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The sub-skill allows external weather lookups using configured providers, browser access, or web retrieval, but it does not require notifying the user that location or related contextual data may be sent to third parties. This creates a privacy transparency gap: users may not realize that requesting weather-aware outfit help could disclose their location or inferred location to external services.
Content: No source excerpt is available for this finding.