New York (State)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:24 PM UTC
• Version: 1.0.1

Overview

The skill is mostly a New York guidance helper, but its optional plaintext memory can store sensitive personal details despite inconsistent privacy promises.

Install only if you are comfortable with optional local continuity notes in ~/new-york/. Do not ask it to save credentials, SSNs, payment details, account numbers, immigration details, medical specifics, or full street addresses, and review or delete memory.md if it is created. For precise location guidance, assume official state or local portals may receive coarse location details and sometimes address-level details if you provide them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: setup.md:58

Finding

Plaintext Persistent Memory May Contain Sensitive Personal Information

Content

View full analysis

Vulnerability Details

File Location: setup.md:58-65; related behavior in memory-template.md:17-23, 53 and SKILL.md:116-120
Vulnerability Type: Plaintext storage of sensitive personal information
Risk Level: Medium

Evidence

markdown

Keep `~/new-york/memory.md` lightweight and useful:
- activation preference for New York topics
- current mode and target region
- major deadlines, open loops, and dependencies
- persistent family, school, housing, transit, and weather constraints
- which official portals or local agencies already matter for this user

Do not store credentials, account numbers, SSNs, full street addresses, immigration-status details, or payment details unless the user explicitly asks for that behavior.

The memory template also permits the collection of personal context:

markdown

## Current Situation
- Mode: visitor / moving / resident / business
- Main region:
- City or suburb:
- County / ZIP / district if known:

## Constraints
- Timeline:
- Budget pressure:
- Family or school needs:
- Vehicle, transit, and commute realities:
- Winter, flood, insurance, or health sensitivities:

It further states:

markdown

- Keep the default memory coarse. Do not store full street addresses or sensitive identifiers unless the user explicitly asks for saved continuity at that level.

Technical Analysis

The Skill uses ~/new-york/memory.md as persistent cross-session storage. This is an ordinary Markdown file, and the reviewed instructions do not require encryption, restrictive file permissions, retention limits, or secure deletion.

Although the default behavior encourages coarse data collection, setup.md:65 and memory-template.md:53 create an exception that permits storage of credentials, account numbers, Social Security numbers, full addresses, immigration details, payment details, or other sensitive identifiers when requested by the user. ...[truncated 2159 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the exception that permits sensitive data storage upon user request.
2. Unconditionally prohibit storage of credentials, authentication tokens, Social Security numbers, account numbers, payment data, immigration records, full street addresses, and detailed medical information.
3. Restrict persistent memory to coarse, low-sensitivity planning context such as region, broad timeline, and general transportation preferences.
4. Make setup.md, memory-template.md, and SKILL.md consistent about prohibited data.
5. Require restrictive permissions for the memory directory and file, such as user-only access where the host platform supports it.
6. Define retention and deletion controls, including a user-facing mechanism to inspect, edit, pause, or erase stored memory.
7. Warn users that local plaintext memory may be included in backups or synchronization systems.
8. If sensitive continuity is an essential feature, use an approved encrypted secret or data store rather than Markdown.

other

Note

• Location: SKILL.md:94

Finding

External Endpoint and Data-Transfer Disclosure Is Incomplete

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:94-107; omitted sources appear in sources.md:17, 23-24, 29-30
Vulnerability Type: Inaccurate external communication disclosure
Risk Level: Low

Evidence

SKILL.md declares a fixed endpoint list and claims that no other data is transmitted:

markdown

## External Endpoints

| Endpoint | Data Sent | Purpose |
|----------|-----------|---------|
| https://www.ny.gov | Page requests only unless user explicitly wants form guidance | State services and resident tasks |
| https://dmv.ny.gov | Page requests only unless user explicitly provides case details | Driver license, REAL ID, registration, title, and inspection workflows |
| https://www.tax.ny.gov | Page requests only unless user explicitly wants tax-specific guidance | State income tax, sales tax, property-tax benefits, and filing references |
| https://nystateofhealth.ny.gov | County or ZIP if the user asks for marketplace coverage help | Health insurance marketplace and plan lookup |
| https://www.dfs.ny.gov | ZIP, county, or region references if the user asks about insurance or financial protection | Insurance, consumer protections, and complaint pathways |
| https://www.nysed.gov | ZIP, city, district, or school references if the user asks for school matching | Education and school district framework |
| https://www.businessexpress.ny.gov | Page requests only unless user explicitly wants permit or filing help | Business licensing, permits, and startup workflows |
| https://www.dhses.ny.gov | County or region references if the user asks for emergency guidance | Preparedness and hazard planning |

No other data is sent externally.

However, sources.md instructs the agent to use additional endpoints:

markdown

- New York Business Express: https://www.businessexpress.ny.gov/
- Department of State corporations and business entities: https://dos.ny.gov/corporations-and-business-entities

...[truncated 2367 chars]

Remediation

View remediation

Remediation Suggestions

1. Add every fixed endpoint named in sources.md to the SKILL.md endpoint table.
2. Replace “No other data is sent externally” with an accurate statement explaining that official county, city, district, utility, transit, and other local-government portals may also be contacted when required.
3. State the categories of data that may be sent to dynamic endpoints, including region, county, ZIP code, district, city, and address.
4. Require explicit, destination-specific confirmation before sending a full street address or similarly precise location information.
5. Prefer coarse location queries and official portals that do not require precise personal information.
6. Avoid placing sensitive case details in URL query strings, analytics-enabled pages, referrer data, or logs.
7. Keep the endpoint declaration synchronized with sources.md as sources are added or removed.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

## Common Mistakes

- Comparing housing by rent alone without heating, taxes, and commute cost.
- Buying near water or on a slope without checking flood or drainage history.
- Assuming a cheaper suburb is cheaper after tolls, trains, or multiple cars.
- Ignoring school district and municipal tax differences between adjacent towns.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · healthcare-and-coverage.md (reported line 33)May include surrounding context.

md

## Common Mistakes

- Comparing housing by rent alone without heating, taxes, and commute cost.
- Buying near water or on a slope without checking flood or drainage history.
- Assuming a cheaper suburb is cheaper after tolls, trains, or multiple cars.
- Ignoring school district and municipal tax differences between adjacent towns.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · housing-and-insurance.md (reported line 33)May include surrounding context.

md

## Common Mistakes

- Comparing housing by rent alone without heating, taxes, and commute cost.
- Buying near water or on a slope without checking flood or drainage history.
- Assuming a cheaper suburb is cheaper after tolls, trains, or multiple cars.
- Ignoring school district and municipal tax differences between adjacent towns.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · regions.md (reported line 43)May include surrounding context.

md

## Common Mistakes

- Comparing housing by rent alone without heating, taxes, and commute cost.
- Buying near water or on a slope without checking flood or drainage history.
- Assuming a cheaper suburb is cheaper after tolls, trains, or multiple cars.
- Ignoring school district and municipal tax differences between adjacent towns.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · utilities-and-bills.md (reported line 34)May include surrounding context.

md

## Common Mistakes

- Comparing housing by rent alone without heating, taxes, and commute cost.
- Buying near water or on a slope without checking flood or drainage history.
- Assuming a cheaper suburb is cheaper after tolls, trains, or multiple cars.
- Ignoring school district and municipal tax differences between adjacent towns.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · work-and-business.md (reported line 37)May include surrounding context.

md

## Common Mistakes

- Comparing housing by rent alone without heating, taxes, and commute cost.
- Buying near water or on a slope without checking flood or drainage history.
- Assuming a cheaper suburb is cheaper after tolls, trains, or multiple cars.
- Ignoring school district and municipal tax differences between adjacent towns.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup instructs the skill to activate 'whenever the user mentions New York State at all,' which is broader than necessary for the skill's stated purpose. Over-broad activation can cause the skill to engage in unrelated conversations, increasing the chance of unnecessary data collection, user confusion, and unintended persistence decisions in contexts where the user did not actually want New York-specific handling.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 80% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · utilities-and-bills.md (reported line 12)May include surrounding context.

md

## What Changes the Bill Most

### 1. Heating type
- Electric heat, gas heat, and fuel-oil or propane setups create very different winter bills and refill logistics.
- In older homes and small towns, the heating system often matters more than the ZIP code average.

### 2. Building efficiency

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation guidance says to use the file for broad categories like power, gas, internet, water, and recurring home cost questions, but it does not define specific trigger phrases, scope limits, or exclusion examples. This ambiguity could cause the skill to be selected for many everyday cost-of-living or housing conversations beyond its intended utility-bill focus.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.