Family

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:57 AM UTC
• Version: 1.0.0

Overview

This family-coordination skill is transparent and local-only, but it asks the agent to persist sensitive household, child, medical, and document-location details without enough technical protection guidance.

Install only if you want a local household memory system. Before saving child, health, pickup, medication, document, or incident details, confirm what will be stored, keep entries minimal, avoid secrets or document numbers, and store the ~/family/ directory somewhere protected from shared accounts, cloud sync, and broad backups.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: memory-template.md:120

Finding

Sensitive family and medical information stored in unprotected plaintext files

Content

View full analysis

Vulnerability Details

File Location: memory-template.md:120-139, memory-template.md:214-278, memory-template.md:368-381; related storage design in SKILL.md:36-60 and SKILL.md:128-133
Vulnerability Type: Plaintext storage of sensitive information without enforced access controls
Risk Level: Medium

Vulnerable Code Snippets

memory-template.md:120-139:

markdown

## `people/children.md`

```markdown
# Children

## Children in Scope
| Name | Age range | School / childcare | Shared logistics | Private sensitivities |
|------|-----------|--------------------|------------------|-----------------------|
|      |           |                    |                  |                       |

## Operational Notes
- Pickup permissions
- Activity gear requirements
- Allergy or medication notes needed for logistics only
- Topics that stay private unless an adult must act

text

`memory-template.md:214-278`:

```markdown
## `logistics/contacts.md`

```markdown
# Contacts

## Priority Contacts
| Name / Place | Type | Why it matters | Preferred contact route |
|--------------|------|----------------|-------------------------|
|              |      |                |                         |

## Notes
- school office
- clinic
- pharmacy
- backup caregiver
- neighbor or local support

care/appointments.md

markdown

# Appointments

## Upcoming
| Date | Person | Appointment | Prep needed | Transport | Follow-up |
|------|--------|-------------|-------------|-----------|-----------|
|      |        |             |             |           |           |

## Follow-Up Queue
- refill
- call back
- forms
- next booking

care/medications.md

markdown

# Medications

## Current Medications
| Person | Medication | Timing | Refill date | Administration notes |
|--------|------------|--------|-------------|----------------------
...[truncated 3640 chars]

Remediation

View remediation

Remediation Suggestions

1. Minimize stored data by default

   • Store only the operational fact required for coordination.
   • Avoid recording diagnoses, detailed symptoms, private sensitivities, full medication histories, or exact identity-document locations unless strictly necessary.
   • Use generalized entries such as “adult confirmation required” instead of detailed private explanations where possible.

2. Enforce restrictive filesystem permissions

   • Create ~/family/ with owner-only permissions, such as mode 0700 on POSIX systems.
   • Create sensitive files with owner-only permissions, such as mode 0600.
   • Verify existing permissions before writing and warn the user if group or public access is enabled.
   • Implement equivalent user-scoped access controls on Windows.

3. Separate private and shared records technically

   • Do not place private notes in the same directory or files as household-shared operational data.
   • Use separate per-person private storage with independently enforced access controls.
   • Keep shared files limited to minimum-necessary handoff information.

4. Protect high-sensitivity records

   • Recommend encrypted storage for medication, health, custody, identity, and document-location information.
   • Prefer references to records in an established encrypted vault rather than duplicating sensitive content in Markdown.
   • Do not store authentication secrets, document numbers, or scanned identity documents in this structure.

5. Provide explicit persistence warnings

   • Before saving sensitive information, explain that the data will remain as plaintext unless protected by the underlying system.
   • Ask for separate, explicit confirmation for health information, minors' details, and document-location metadata.
   • Alert users that backups, search indexing, and synchronization software may copy the files.

6. Add retention and deletion controls

...[truncated 605 chars]

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The template instructs creation of a persistent local family memory store containing highly sensitive data: children, dependents, medical appointments, medications, school logistics, contacts, incidents, and household access boundaries. Although it says to create the directory only after approval, it lacks explicit privacy, minimization, retention, access control, and encryption guidance, which increases the risk of oversharing, unsafe persistence of minors' and health data, and accidental exposure to other local users, backups, or synced folders.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Telling the assistant to read the setup 'silently' when a directory is missing or empty reduces transparency about when the skill is activating and what instructions are shaping behavior. In a family-management context involving private household, child, and care information, hidden activation undermines meaningful consent and can lead to unnoticed handling of sensitive data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation rule is broad enough to trigger on many ordinary conversations about home, children, meals, or appointments, which can cause the assistant to enter a family-coordination mode without sufficiently clear user intent. In a skill that stores household preferences and boundaries, this increases the risk of unintended collection, retention, or use of sensitive family information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow explicitly instructs users to record school and care-coordination details, including child-related logistics and appointment or medication information, but does not provide any privacy boundaries, minimization guidance, or warning about handling sensitive personal data. In a family-management skill, this can lead to oversharing of children's, health, and household information into shared notes or memories that may be accessible to unintended household members or downstream systems.

Content

No source excerpt is available for this finding.