Security audit

Macau

Security checks for vulnerabilities and agentic risk

Overview

This is a Macau travel and relocation guide that uses a narrow local memory file and does not show hidden execution, network access, credential use, or destructive behavior.

Before installing, be aware that the skill may create and reuse ~/macau/memory.md with Macau trip, budget, district, border, work, study, or relocation context. Review or delete that file if you do not want this context retained between sessions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The invocation guidance says to use the skill when a user asks about Macau 'for any purpose,' which is very broad and does not define clear boundaries for when this skill should or should not activate. It also lacks negative examples or narrower trigger constraints, increasing the chance of unintended invocation on casual or incidental Macau references.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: | Value | Meaning | Behavior | |-------|---------|----------| | `ongoing` | Still learning | Keep collecting context naturally | | `complete` | Enough context exists | Reuse without asking much | | `paused` | User does not want setup now | Work with current context only | | `never_ask` | User explicitly declined | Never ask for more setup |
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to create a persistent local memory store on disk, but it does not require a clear user-facing disclosure that conversation-derived context will be stored and reused. This creates a privacy and consent risk because potentially sensitive travel, visa, work, school, or relocation details may be retained beyond the current session without explicit informed consent.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: ```bash mkdir -p ~/macau touch ~/macau/memory.md chmod 700 ~/macau chmod 600 ~/macau/memory.md ```
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: mkdir -p ~/macau touch ~/macau/memory.md chmod 700 ~/macau chmod 600 ~/macau/memory.md ``` If `~/macau/memory.md` is empty, initialize it from `memory-template.md`.
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The returning-user workflow says to read, reuse, and update persistent memory, but it does not clearly disclose ongoing storage and retrieval of user context. That makes the privacy issue continuous rather than one-time, increasing the chance that sensitive personal preferences or constraints are silently profiled across sessions.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: - Do not promise immigration or border outcomes. - Do not collapse Macau into "just casinos" if the user is asking about culture, schooling, or residence. - Do not give travel-time estimates without checking port, bridge, or weather context. - Do not assume cards or HKD work everywhere just because they work in hotels and casinos.
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: - Do not promise immigration or border outcomes. - Do not collapse Macau into "just casinos" if the user is asking about culture, schooling, or residence. - Do not give travel-time estimates without checking port, bridge, or weather context. - Do not assume cards or HKD work everywhere just because they work in hotels and casinos.
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Low

Confidence: 91% confidence
Finding: The markdown lists example user statements such as "I want a calmer side of Macau" and "I do not care about casino energy" as recommendation triggers, but it does not define whether these are exhaustive triggers or provide exclusion conditions. Because these are ordinary travel-preference statements, the skill could be invoked in broader contexts than intended.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The heading includes "Senado / St. Paul's Belt," where "Senado" is a locale-specific term that may not be understandable to all users. The file does not offer any language or terminology clarification, which can be read as a mild language/locale policy issue in natural-language content.

Natural-Language Policy Violations

Low

Confidence: 89% confidence
Finding: The statement that 'English alone works unevenly outside resorts and top institutions' communicates a locale/language constraint in natural language without presenting alternatives or user choice. Under the policy, language-related constraints can be findings when they are stated as requirements without opt-in or a clearly documented region-specific justification.

Static analysis

No suspicious patterns detected.