AirTag

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:16 AM UTC
• Version: 1.0.0

Overview

This AirTag helper matches its stated purpose and requires confirmation for sensitive actions, but it can handle and locally save sensitive item-location details.

Before installing, be comfortable letting an agent assist with Find My/AirTag workflows. Prefer Direct App Control or Shared Link Mode when possible, use API Mode only with a connector you trust, approve each location pull or local write deliberately, and periodically review or delete ~/airtag/ notes that contain locations, safe zones, or incident history.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:32

Finding

Plaintext Persistence of Sensitive AirTag Location and Behavioral Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:32-40, memory-template.md:3-26, setup.md:41-50, and recovery-playbook.md:49-53
Vulnerability Type: Plaintext storage of sensitive location, ownership, and behavioral information
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:32-40:

markdown

Memory lives in `~/airtag/`. See `memory-template.md` for structure and status fields.

```text
~/airtag/
|-- memory.md          # Status, active connector mode, and operating boundaries
|-- items.md           # AirTag inventory, aliases, and ownership context
|-- incidents.md       # Lost-item timelines, actions taken, and outcomes
|-- maintenance.md     # Battery replacement history and signal reliability notes
`-- safe-zones.md      # Frequent locations and expected left-behind behavior

text

`memory-template.md:3-26`:

```markdown
Create `~/airtag/memory.md` with this structure:

```markdown
# AirTag Memory

## Status
status: ongoing
version: 1.0.0
last: YYYY-MM-DD
integration: pending | done | declined

## Context
<!-- Stable environment details, in natural language -->
<!-- Example: User carries two AirTags (keys, backpack) and often commutes by train -->

## Notes
<!-- Operational observations and repeated patterns -->
<!-- Example: Precision Finding fails indoors on office floor 12; map ring still works -->

## Active Incidents
<!-- Open incidents with timestamp, item, last-known location, and next action -->

---
*Updated: YYYY-MM-DD*

text

`setup.md:41-50`:

```markdown
## What to Save Internally

Store these categories when user-approved:
- Activation boundaries and proactive/ask-only preference
- Chosen default connector mode and constraints
- Stable inventory facts (items, aliases, ownership context)
- Repeated failures and validated fixes
- Safety preferences for unknown-AirTag notifications

Keep records concise and operation
...[truncated 3191 chars]

Remediation

View remediation

Remediation Suggestions

1. Default to ephemeral processing and make persistence explicitly opt-in for each category of sensitive information.
2. Create ~/airtag/ with owner-only permissions such as mode 0700, and create stored files with mode 0600.
3. Store precise locations in operating-system-protected encrypted storage rather than plaintext Markdown.
4. Record coarse descriptions or redacted location identifiers unless exact coordinates are essential to an active recovery.
5. Avoid retaining safe zones, movement history, and ownership context unless the user separately confirms that each category is necessary.
6. Establish short retention periods for active incidents and automatically remove expired location records.
7. Provide a user-visible command to review, export, redact, and securely delete all saved AirTag data.
8. Warn users when the storage directory may be included in cloud synchronization or backups.
9. Document that connector session material, authentication tokens, shared-link secrets, and raw credentials must never be written to these files.
10. Preserve the existing requirement for explicit confirmation before every connector action, location pull, or local write.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

- Modify its own `SKILL.md`.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation guidance is overly broad because it tells the agent to activate on generic phrases like 'lost items,' which can appear in many unrelated conversations. In a skill that can access AirTag/Find My account context and potentially intervene proactively, this increases the chance of unintended activation, unnecessary collection of sensitive account/location context, or action in the wrong user scenario.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to store account-linked inventory facts, ownership context, repeated failures, and safety preferences, but it does not require a clear user-facing notice about retention, scope, or privacy implications. Because this skill handles highly sensitive location-adjacent and account data, silent persistence can expose users to privacy harms, over-collection, and retention of information beyond what they expect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.