Friends

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:16 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent friendship tracker, but it encourages long-term plaintext records of sensitive details about identifiable friends without clear consent, deletion, or privacy controls.

Install only if you are comfortable maintaining a private local relationship journal about other people. Avoid saving health, mental-health, relationship, children, grief, conflict, or location details unless you deliberately choose to, and consider restricting the folder permissions, excluding it from sync/backups, and periodically reviewing or deleting old records.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18
• Finding: Persistent Plaintext Storage of Sensitive Third-Party Personal Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:18-47`, `SKILL.md:80-86`; supporting instruction at `deepening.md:23-28` **Vulnerability Type**: Plaintext storage and overcollection of sensitive personal data **Risk Level**: Medium ### Complete Vulnerable Code Snippets From `SKILL.md:18-47`: ```md - User mentions a friend → check if exists, offer to create/update - Interaction detected → log it, note context - Friendship fading → surface proactively with reconnection prompt - Create `~/friends/` as workspace ## When User Mentions Someone - "Had dinner with Carlos" → log interaction, create if new - "Ana's going through a divorce" → add to life events, flag for check-ins - "Pedro moved to Berlin" → update location - "Haven't seen Maria in months" → surface last interaction, suggest reach out ## Friend Structure - One Markdown file per person: carlos-martinez.md - Sections: basics, how we met, life events, interaction history, friendship notes - Tags for circles: #inner-circle #close #wider #reconnecting - Readable format — this is about relationships, not database ## Key Fields To Capture - Name, how you met, when friendship started - Birthday, important dates - Current life situation: job, relationship, kids, city - What they care about, what's going on in their life - Last interaction and what you talked about - What kind of friend they are (activity buddy, deep talks, etc.) ## Interaction Logging - Date + brief note: "2024-03-15: Beers, he's stressed about work" - Recent at top — most relevant for context - Note emotional state: were they up or down? - Flag follow-ups: "said he'd let me know about the job" ``` From `SKILL.md:80-86`: ```md ## Life Events Worth Tracking - Job changes, promotions, layoffs - Relationships: new partner, breakup, divorce, marriage - Kids: pregnancy, birth, milestones - Health: illness, recovery, mental health struggles - Moves: new city, new home - Losses: death in family, pet, hardship ``` Supporting instr ...[truncated 3086 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, per-record confirmation before creating a friend file or persisting information inferred from conversation. 2. Require separate confirmation before storing sensitive categories such as health, mental health, children, pregnancy, relationship problems, losses, or conflicts. 3. Apply data minimization by default. Store only details necessary for a user-requested reminder and avoid free-form personal dossiers. 4. Create the workspace with owner-only permissions, such as mode `0700`, and individual files with mode `0600`. 5. Use an application-private storage directory rather than a broadly discoverable general-purpose folder. 6. Encrypt sensitive records at rest using a key protected by the operating system's credential store or keychain. 7. Avoid identifiable filenames. Use opaque identifiers and keep any identity mapping inside protected storage. 8. Add configurable retention periods and automatic deletion for stale interactions and sensitive life events. 9. Provide commands to review, correct, export, and permanently delete individual details or complete records. 10. Warn the user before enabling calendar, contacts, backup, or synchronization integration, and request only narrowly scoped authorization. 11. Ensure generated reminders reveal minimal information on lock screens, shared calendars, logs, and notification systems. 12. Document the local privacy model, including who can access the records, where copies may be created, and how deletion affects backups. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill collects and stores highly sensitive personal data about third parties, including relationship problems, health struggles, family events, and emotional state, without any explicit privacy notice or consent boundary. This creates a substantial privacy risk because users may casually disclose information that is then retained long-term in local files without realizing the sensitivity or downstream exposure.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill is designed to trigger whenever a user mentions a friend, which is an overly broad activation condition that can cause the agent to engage storage and profiling behavior in contexts where the user did not intend to use this system. In this skill, that broad trigger is more dangerous because invocation can lead directly to persistent logging of sensitive third-party relationship data.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: These instructions tell the agent to persistently record sensitive third-party details such as divorce, relocation, and personal struggles, then use them later for prompts and follow-ups. Persisting personal information about non-users in a long-lived workspace raises meaningful privacy, confidentiality, and misuse risks, especially when the information may be intimate or not shared with consent for recordkeeping.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: The skill explicitly encourages logging health issues, mental health struggles, relationship changes, losses, and other sensitive life events in durable files. Those categories are especially risky because they involve intimate data about third parties, and if exposed or resurfaced inappropriately they could cause reputational harm, emotional harm, or unauthorized disclosure.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Proactively resurfacing previously stored personal details before future meetings increases the chance of inappropriate disclosure, overcollection, and manipulative profiling. In this context, the feature is more dangerous because it operationalizes sensitive memory into repeated prompts, normalizing long-term surveillance-style tracking of third-party personal lives.

Static analysis

No suspicious patterns detected.