T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:18- Finding
Persistent Plaintext Storage of Sensitive Third-Party Personal Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Friends
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent friendship tracker, but it encourages long-term plaintext records of sensitive details about identifiable friends without clear consent, deletion, or privacy controls.
Install only if you are comfortable maintaining a private local relationship journal about other people. Avoid saving health, mental-health, relationship, children, grief, conflict, or location details unless you deliberately choose to, and consider restricting the folder permissions, excluding it from sync/backups, and periodically reviewing or deleting old records.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill collects and stores highly sensitive personal data about third parties, including relationship problems, health struggles, family events, and emotional state, without any explicit privacy notice or consent boundary. This creates a substantial privacy risk because users may casually disclose information that is then retained long-term in local files without realizing the sensitivity or downstream exposure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill is designed to trigger whenever a user mentions a friend, which is an overly broad activation condition that can cause the agent to engage storage and profiling behavior in contexts where the user did not intend to use this system. In this skill, that broad trigger is more dangerous because invocation can lead directly to persistent logging of sensitive third-party relationship data.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These instructions tell the agent to persistently record sensitive third-party details such as divorce, relocation, and personal struggles, then use them later for prompts and follow-ups. Persisting personal information about non-users in a long-lived workspace raises meaningful privacy, confidentiality, and misuse risks, especially when the information may be intimate or not shared with consent for recordkeeping.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly encourages logging health issues, mental health struggles, relationship changes, losses, and other sensitive life events in durable files. Those categories are especially risky because they involve intimate data about third parties, and if exposed or resurfaced inappropriately they could cause reputational harm, emotional harm, or unauthorized disclosure.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Proactively resurfacing previously stored personal details before future meetings increases the chance of inappropriate disclosure, overcollection, and manipulative profiling. In this context, the feature is more dangerous because it operationalizes sensitive memory into repeated prompts, normalizing long-term surveillance-style tracking of third-party personal lives.
- Content
Static analysis
No suspicious patterns detected.