T09 · Insecure Skill Coding Practices
Warning
- Location
memory-guide.md:20- Finding
Persistent Plaintext Storage of Sensitive User Profiles
- Content
View full analysis
- Remediation
View remediation
Security audit
Companion
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent companion skill, but it persistently stores sensitive personal profiles and conversation history without enough user control or privacy safeguards.
Install only if you are comfortable with the agent keeping a local plaintext companion profile. Before use, decide what may be remembered, periodically inspect ~/companion/, delete entries you do not want retained, and avoid storing health, crisis, location, caregiver, or routine details unless you intentionally want that persistence.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:20- Finding
Persistent Memory Poisoning Through Automatically Loaded User-Controlled Markdown
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs the agent to persist sensitive personal and conversational data in a user-home directory, including health context, routines, and conversation history, but provides no notice, consent flow, retention limit, access control guidance, or deletion mechanism. In a companionship context, users are especially likely to disclose intimate or health-related information, so silent long-term storage materially increases privacy harm if the host, another local process, or a later agent session reads those files.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide instructs the skill to maintain a persistent, structured dossier containing identity, relationships, routines, moods, and conversation history. For a companion skill whose stated purpose is simply to talk with users, this creates unnecessary long-term profiling and increases the harm from misuse, overcollection, or data exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file describes storing sensitive personal data and conversation history but does not present any explicit warning, consent flow, or retention disclosure to the user. This undermines informed consent and makes users likely to reveal intimate information without understanding that it will be persistently recorded.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is designed to collect sensitive personal context including location, living situation, health notes, caregivers, family structure, and behavioral patterns. In a companionship context, this level of collection is disproportionate and can enable intimate profiling, targeting of vulnerable users, or serious privacy harm if the data is leaked or repurposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide explicitly encourages inferring meaning from what the user does not say and from behavioral patterns, which amounts to covert profiling. In a companion skill aimed at potentially lonely or emotionally vulnerable users, undisclosed inference about sensitivities, rhythms, and emotional states materially increases manipulation and privacy risk.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill explicitly guides emotionally sensitive conversations such as loss, fear, and feeling down, but it provides no boundary note that the interaction is non-professional support and no escalation guidance for users in crisis. In a companionship skill, this can lead users to over-rely on the agent for mental-health-adjacent support or receive responses that are insufficient in higher-risk situations.
- Content
Static analysis
No suspicious patterns detected.