Companion

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:42 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent companion skill, but it persistently stores sensitive personal profiles and conversation history without enough user control or privacy safeguards.

Install only if you are comfortable with the agent keeping a local plaintext companion profile. Before use, decide what may be remembered, periodically inspect ~/companion/, delete entries you do not want retained, and avoid storing health, crisis, location, caregiver, or routine details unless you intentionally want that persistence.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: memory-guide.md:20
• Finding: Persistent Plaintext Storage of Sensitive User Profiles<![CDATA[ ## Vulnerability Details **File Location**: `memory-guide.md:20-51` **Additional Location**: `SKILL.md:20-30` **Vulnerability Type**: Plaintext storage of sensitive personal data **Risk Level**: Medium ### Vulnerable Code ```markdown ## memory.md (HOT — Always Loaded) Keep under 100 lines. Core information about them. ```markdown # Companion Memory ## Who They Are - Name: - Age/generation: - Living situation: (alone, with family, care facility) - Location: ## Current Situation - Health: (general notes, not medical advice territory) - Daily life: (retired, working, caregiving) - Mood lately: (how they've seemed recently) ## Key People - Family: (names, relationships, how often they see them) - Caregivers: (if relevant) - Friends: (who they mention) - Pets: (names, types) ## What They Enjoy - Topics: (gardening, old movies, grandchildren) - Routines: (morning tea, evening news) - Memories: (stories they like to tell) ## What to Avoid - Sensitive topics: (loss they don't want to discuss) - Frustrations: (things that upset them) ## How They Reach Out - Typical times: (morning, evening, random) - Platform/method: - Communication style: (brief, chatty, formal) ## Recent ``` The storage and loading instructions are defined in `SKILL.md:20-30`: ```markdown ## Memory Storage All user data lives at `~/companion/`. Read on activation. ``` ~/companion/ ├── memory.md # HOT: who they are, situation (≤100 lines) ├── topics.md # What they enjoy talking about ├── routines.md # Their daily life, when they reach out └── history.md # Past conversations, themes ``` **On activation:** Load `~/companion/memory.md` first. Load topic files when relevant. ``` ### Technical Analysis The Skill directs the Agent to create persistent Markdown profiles containing names, locations, living arrangements, health information, mood assessments, relationships, routines, sensitive topics, and communication patterns. These records are stored under ...[truncated 2323 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed opt-in before creating persistent memory. 2. Default to no persistent storage, especially for health, location, mood, and sensitive relationship information. 3. Apply strict data minimization and store only information necessary for a user-requested feature. 4. Replace free-form Markdown profiles with a structured schema containing an explicit allowlist of permitted fields. 5. Enforce owner-only file and directory permissions, such as mode `0700` for the directory and `0600` for files. 6. Use operating-system-protected or encrypted storage where supported. 7. Define short retention periods and automatically expire stale records rather than archiving them indefinitely. 8. Provide commands or controls that let users inspect, correct, export, and permanently delete all stored information. 9. Separate profiles by authenticated user and prevent memory from being shared across users or sessions unintentionally. 10. Avoid storing inferred attributes, including conclusions drawn from silence, mood, or behavioral patterns, without explicit confirmation. 11. Document backup handling and ensure deletion also covers retained copies where technically possible. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:20
• Finding: Persistent Memory Poisoning Through Automatically Loaded User-Controlled Markdown<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-30` **Additional Location**: `memory-guide.md:149-159` **Vulnerability Type**: Persistent prompt injection through long-term memory **Risk Level**: Medium ### Vulnerable Code ```markdown ## Memory Storage All user data lives at `~/companion/`. Read on activation. ``` ~/companion/ ├── memory.md # HOT: who they are, situation (≤100 lines) ├── topics.md # What they enjoy talking about ├── routines.md # Their daily life, when they reach out └── history.md # Past conversations, themes ``` **On activation:** Load `~/companion/memory.md` first. Load topic files when relevant. ``` The update rules in `memory-guide.md:149-159` expand the user-controlled content that can enter persistent memory: ```markdown ## How I Learn **From what they share:** Names, places, stories — I note them. **From patterns:** If they always reach out after dinner, I know their rhythm. **From corrections:** If I get something wrong, I update. **From what they don't say:** Avoiding a topic tells me something too. ## Memory Rules 1. **memory.md always loads** — keep it lean 2. **Topic files on demand** — load when relevant 3. **Update after significant conversations** — don't let knowledge go stale ``` ### Technical Analysis The Skill instructs the Agent to derive memory from user conversations, write it into free-form Markdown files, and automatically load `memory.md` during future activations. The documentation does not establish a trust boundary between stored data and executable Agent instructions. Because Markdown supports unrestricted natural-language content, a user can provide text that resembles system instructions, tool directives, safety exceptions, or behavioral rules. If that content is copied or summarized into memory without sanitization, a later Agent session may interpret it as an instruction rather than as untrusted profile data. The missing protections include: - A structu ...[truncated 2315 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every memory file as untrusted data and state this explicitly in the Skill instructions. 2. Add a mandatory rule that instructions, requests, commands, and policy statements found in memory must never be followed. 3. Replace free-form Markdown storage with a typed, allowlisted schema containing only factual profile fields. 4. Reject or quarantine values containing imperative language, role changes, tool directives, policy overrides, or encoded payloads. 5. Load memory inside a clearly delimited data block with provenance metadata, rather than concatenating it into an instructional context. 6. Record the source and timestamp of each memory item and distinguish direct user statements from Agent inferences. 7. Require user confirmation before persisting unusual, sensitive, or behavior-changing information. 8. Validate and sanitize all existing memory files before loading them. 9. Apply restrictive filesystem permissions and integrity checks to reduce tampering by other local processes. 10. Never allow memory content to authorize tool calls, change safety policy, request secrets, or override higher-priority instructions. 11. Provide a safe reset mechanism that removes poisoned memory without requiring manual filesystem access. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to persist sensitive personal and conversational data in a user-home directory, including health context, routines, and conversation history, but provides no notice, consent flow, retention limit, access control guidance, or deletion mechanism. In a companionship context, users are especially likely to disclose intimate or health-related information, so silent long-term storage materially increases privacy harm if the host, another local process, or a later agent session reads those files.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The guide instructs the skill to maintain a persistent, structured dossier containing identity, relationships, routines, moods, and conversation history. For a companion skill whose stated purpose is simply to talk with users, this creates unnecessary long-term profiling and increases the harm from misuse, overcollection, or data exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file describes storing sensitive personal data and conversation history but does not present any explicit warning, consent flow, or retention disclosure to the user. This undermines informed consent and makes users likely to reveal intimate information without understanding that it will be persistently recorded.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill is designed to collect sensitive personal context including location, living situation, health notes, caregivers, family structure, and behavioral patterns. In a companionship context, this level of collection is disproportionate and can enable intimate profiling, targeting of vulnerable users, or serious privacy harm if the data is leaked or repurposed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide explicitly encourages inferring meaning from what the user does not say and from behavioral patterns, which amounts to covert profiling. In a companion skill aimed at potentially lonely or emotionally vulnerable users, undisclosed inference about sensitivities, rhythms, and emotional states materially increases manipulation and privacy risk.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill explicitly guides emotionally sensitive conversations such as loss, fear, and feeling down, but it provides no boundary note that the interaction is non-professional support and no escalation guidance for users in crisis. In a companionship skill, this can lead users to over-rely on the agent for mental-health-adjacent support or receive responses that are insufficient in higher-risk situations.

Static analysis

No suspicious patterns detected.