Cofounder

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:00 PM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned as a founder-advice assistant, but it stores sensitive business and personal profile notes persistently without clear upfront user consent or deletion controls.

Review this skill carefully before installing. Its advice behavior is coherent, and there is no evidence of code execution or data exfiltration, but it is designed to build a persistent local profile of your venture, goals, weaknesses, decision style, and preferences. Only use it if you are comfortable with that file existing under ~/cofounder/, and inspect or delete the memory files if you do not want that information retained.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: setup.md:47

Finding

Undisclosed Persistent Storage of Sensitive User and Venture Profiles in Plaintext

Content

View full analysis

Vulnerability Details

File Location: setup.md:47-54; related instructions in SKILL.md:24-30 and memory-template.md:1-50
Vulnerability Type: Persistent plaintext storage of potentially sensitive profile data without an explicit consent, access-control, retention, or deletion requirement
Risk Level: Medium

Vulnerable Code Snippets

setup.md:47-54:

markdown

## What You're Saving (internally)

As you talk, you're building:
- Their venture profile (type, stage, goals)
- Their personal profile (strengths, blindspots, style)
- The dynamic you'll bring (where to challenge them)

Save this in memory.md. Update it as you learn more over time.

setup.md:1-3:

markdown

# Setup — Cofounder

Read this when `~/cofounder/` doesn't exist or is empty. Start naturally — don't announce you're doing "setup."

SKILL.md:24-30:

markdown

## Architecture

Memory lives in `~/cofounder/`. See `memory-template.md` for structure.

~/cofounder/ ├── memory.md # Profile + venture + ongoing observations └── interventions.md # Log of balance interventions (optional)

text

memory-template.md:1-50:

markdown

# Memory Template — Cofounder

Create `~/cofounder/memory.md` with this structure:

```markdown
# Cofounder Memory

## Status
status: ongoing
version: 1.0.0
last: YYYY-MM-DD
integration: pending | done

## Venture

**What they're building:**
<!-- One sentence description -->

**Stage:**
<!-- idea | building | launched | growing | scaling -->

**Type:**
<!-- vc-startup | bootstrapped-saas | agency | side-project | creator-business | other -->

**Goals:**
<!-- What success looks like to them -->

## Profile

**Background:**
<!-- Technical, business, design, domain expert, etc. -->

**Strengths (what they're good at):**
<!-- List their strong areas -->

**Blindspots (what they avoid or struggle with):**
<!-- List areas they need help -->

**Decision style:**
<!-- data-driven | in
...[truncated 3191 chars]

Remediation

View remediation

Remediation Suggestions

1. Require informed opt-in before persistence

   • Tell the user what categories of information will be saved.
   • Explain the purpose and storage location.
   • Do not create or update the profile until the user explicitly agrees.
   • Offer a non-persistent mode.

2. Replace silent setup behavior

   • Remove or qualify the instruction to avoid announcing setup.
   • Require a concise disclosure before collecting or storing inferred personal information.

3. Apply data minimization

   • Save only information necessary for the requested functionality.
   • Avoid storing sensitive personal, financial, health, credential, or confidential business information.
   • Separate user-provided facts from uncertain agent inferences.

4. Harden local storage

   • Create ~/cofounder/ with owner-only permissions, such as mode 0700.
   • Create memory.md and related files with owner-only permissions, such as mode 0600.
   • Refuse to use the path if it is a symbolic link or has unsafe ownership or permissions.
   • Use secure writes that avoid exposing partial content or overly permissive temporary files.

5. Provide lifecycle controls

   • Define a retention period and automatically remove stale observations.
   • Allow the user to inspect, correct, export, disable, and delete stored memory.
   • Confirm deletion of both primary files and any generated backups.

6. Add sensitivity and accuracy controls

   • Ask for separate confirmation before retaining particularly sensitive facts.
   • Label inferred traits as tentative rather than factual.
   • Periodically ask whether stored observations remain accurate and necessary.

SkillSpector

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs the agent to persist sensitive user profiling data—venture details, strengths, blind spots, working style, and preferences—to memory.md without requiring explicit user notice or consent. This creates a privacy and data-retention risk because personal and potentially business-sensitive information may be stored locally across sessions in a way the user does not expect.

Content

No source excerpt is available for this finding.

Persistent Context Injection

Medium

• Category: Memory Poisoning
• Confidence: 94% confidence

Finding

Persistent storage of conversationally derived profile data in memory.md enables context injection and privacy carryover across future interactions. If that file is later consumed as trusted context, stale, manipulated, or overly sensitive information could influence future agent behavior in ways the user did not intend, especially because the saved content includes subjective assessments like blind spots and challenge areas.

Content

Scanner excerpt · setup.md (reported line 55)May include surrounding context.

md

- Their personal profile (strengths, blindspots, style)
- The dynamic you'll bring (where to challenge them)

Save this in memory.md. Update it as you learn more over time.

## Integration

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instruction says to read this when ~/cofounder/ "doesn't exist or is empty," but it does not define who checks that condition, when the check occurs, or whether any other prerequisites apply. For a markdown skill file, this can create unclear invocation boundaries and increase the chance of unintended setup behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.