Anxiety (Tracker, Trigger Map, Coping Planner)

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:11 AM UTC
• Version: 1.0.0

Overview

This is a disclosed, instruction-only anxiety tracking skill with local storage and no network or executable behavior, but the records it creates are sensitive and should be protected.

Before installing, be aware that the skill can create sensitive anxiety logs, thought records, trigger maps, exposure notes, and escalation preferences in ~/anxiety/. Use it only if you are comfortable keeping that information in local Markdown files, and consider restricting file permissions, avoiding cloud-synced folders, and deleting records you no longer need.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: memory-template.md:3

Finding

Predictable Plaintext Storage of Sensitive Mental-Health Records

Content

View full analysis

Vulnerability Details

File Location: memory-template.md:3-48 (related storage instructions also appear in SKILL.md:22-32, SKILL.md:49-52, SKILL.md:120-122, and setup.md:42-49)
Vulnerability Type: Sensitive information stored in plaintext without defined access controls
Risk Level: Medium

Vulnerable Code Snippet

markdown

Create `~/anxiety/memory.md` with this structure:

```markdown
# Anxiety Memory

## Status
status: ongoing
version: 1.0.0
last: YYYY-MM-DD
integration: pending | complete | paused | never_ask

## Active Mode
mode: track | reduce | recover
primary_goal:
secondary_goal:

## Baseline Snapshot
typical_trigger_windows:
common_body_signals:
peak_intensity_range:
usual_episode_duration:

## Trigger and Behavior Patterns
top_triggers:
avoidance_patterns:
safety_behaviors:
helpful_coping:

## Active Plan
plan_start:
this_week_focus:
next_check_in:
current_exposure_step:

## Escalation Preferences
urgent_contact_flow:
preferred_language_in_crisis:
professional_support_status:

## Notes
- Confirmed patterns
- Failed tactics to avoid repeating
- Open questions for therapy or medical follow-up

---
*Updated: YYYY-MM-DD*

text

The broader storage design additionally creates predictable Markdown files for anxiety events, thought records, trigger maps, exposure outcomes, and weekly reviews under `~/anxiety/`.

### Technical Analysis

The Skill directs the agent to persist highly sensitive mental-health information in ordinary Markdown files at a fixed, predictable path. The instructions do not require owner-only permissions, encryption at rest, protection from indexing or backups, retention limits, or secure deletion.

User confirmation before writing is a useful consent control, but it does not protect the resulting records after creation. Depending on the host's default umask and filesystem configuration, files may be accessible 
...[truncated 1601 chars]

Remediation

View remediation

Remediation Suggestions

1. Create ~/anxiety/ with owner-only permissions equivalent to 0700.
2. Create all record files with owner read/write permissions equivalent to 0600, without relying solely on the host's default umask.
3. Verify existing permissions before every write and refuse or warn when the directory is writable or readable by unintended principals.
4. Offer encrypted storage using a platform credential vault or a user-controlled encryption key.
5. Provide a session-only mode that does not persist records and make it the recommended option for users who do not need longitudinal tracking.
6. Clearly disclose that plaintext files may be indexed, synchronized, or included in backups before obtaining write consent.
7. Minimize stored content, especially crisis preferences and detailed thought records, to information strictly necessary for future support.
8. Define configurable retention periods and provide explicit deletion, export, and secure cleanup workflows.
9. Avoid storing records in cloud-synchronized directories unless the user explicitly opts in after receiving a privacy warning.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs creation of multiple local files containing highly sensitive mental-health data, including anxiety episodes, triggers, thought records, escalation preferences, and professional support status, but provides no privacy notice, consent step, retention guidance, or storage protection recommendations. This can expose intimate health information to other local users, backups, sync services, malware, or later unintended reuse by the agent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation criteria are intentionally broad, covering terms like stress spikes, worry loops, and overwhelm that frequently appear in normal conversation. In an always-on agent, this can cause the skill to trigger in contexts the user did not intend, leading to inappropriate mental-health-style interventions, privacy-invasive data collection, or disruption of unrelated tasks.

Content

No source excerpt is available for this finding.