Anxiety (Tracker, Trigger Map, Coping Planner)

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:11 AM UTC
• Version: 1.0.0

Overview

This is a disclosed, instruction-only anxiety tracking skill with local storage and no network or executable behavior, but the records it creates are sensitive and should be protected.

Before installing, be aware that the skill can create sensitive anxiety logs, thought records, trigger maps, exposure notes, and escalation preferences in ~/anxiety/. Use it only if you are comfortable keeping that information in local Markdown files, and consider restricting file permissions, avoiding cloud-synced folders, and deleting records you no longer need.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: memory-template.md:3
• Finding: Predictable Plaintext Storage of Sensitive Mental-Health Records## Vulnerability Details **File Location**: `memory-template.md:3-48` (related storage instructions also appear in `SKILL.md:22-32`, `SKILL.md:49-52`, `SKILL.md:120-122`, and `setup.md:42-49`) **Vulnerability Type**: Sensitive information stored in plaintext without defined access controls **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown Create `~/anxiety/memory.md` with this structure: ```markdown # Anxiety Memory ## Status status: ongoing version: 1.0.0 last: YYYY-MM-DD integration: pending | complete | paused | never_ask ## Active Mode mode: track | reduce | recover primary_goal: secondary_goal: ## Baseline Snapshot typical_trigger_windows: common_body_signals: peak_intensity_range: usual_episode_duration: ## Trigger and Behavior Patterns top_triggers: avoidance_patterns: safety_behaviors: helpful_coping: ## Active Plan plan_start: this_week_focus: next_check_in: current_exposure_step: ## Escalation Preferences urgent_contact_flow: preferred_language_in_crisis: professional_support_status: ## Notes - Confirmed patterns - Failed tactics to avoid repeating - Open questions for therapy or medical follow-up --- *Updated: YYYY-MM-DD* ``` ``` The broader storage design additionally creates predictable Markdown files for anxiety events, thought records, trigger maps, exposure outcomes, and weekly reviews under `~/anxiety/`. ### Technical Analysis The Skill directs the agent to persist highly sensitive mental-health information in ordinary Markdown files at a fixed, predictable path. The instructions do not require owner-only permissions, encryption at rest, protection from indexing or backups, retention limits, or secure deletion. User confirmation before writing is a useful consent control, but it does not protect the resulting records after creation. Depending on the host's default umask and filesystem configuration, files may be accessible ...[truncated 1601 chars]
• Remediation: ## Remediation Suggestions 1. Create `~/anxiety/` with owner-only permissions equivalent to `0700`. 2. Create all record files with owner read/write permissions equivalent to `0600`, without relying solely on the host's default umask. 3. Verify existing permissions before every write and refuse or warn when the directory is writable or readable by unintended principals. 4. Offer encrypted storage using a platform credential vault or a user-controlled encryption key. 5. Provide a session-only mode that does not persist records and make it the recommended option for users who do not need longitudinal tracking. 6. Clearly disclose that plaintext files may be indexed, synchronized, or included in backups before obtaining write consent. 7. Minimize stored content, especially crisis preferences and detailed thought records, to information strictly necessary for future support. 8. Define configurable retention periods and provide explicit deletion, export, and secure cleanup workflows. 9. Avoid storing records in cloud-synchronized directories unless the user explicitly opts in after receiving a privacy warning.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs creation of multiple local files containing highly sensitive mental-health data, including anxiety episodes, triggers, thought records, escalation preferences, and professional support status, but provides no privacy notice, consent step, retention guidance, or storage protection recommendations. This can expose intimate health information to other local users, backups, sync services, malware, or later unintended reuse by the agent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The activation criteria are intentionally broad, covering terms like stress spikes, worry loops, and overwhelm that frequently appear in normal conversation. In an always-on agent, this can cause the skill to trigger in contexts the user did not intend, leading to inappropriate mental-health-style interventions, privacy-invasive data collection, or disruption of unrelated tasks.

Static analysis

No suspicious patterns detected.