Recommend

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:38 PM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned for recommendations, but it directs broad personal-context searches and persistent preference updates without clear consent or controls.

Install only if you are comfortable with the agent consulting stored personal context and remembering inferred preferences. Prefer using it with memory disabled or after adding explicit confirmation before reading history or writing long-term preferences.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: sources.md:3
• Finding: Broad Access to Private User Context Without Explicit Consent or Data Minimization<![CDATA[ ## Vulnerability Details **File Location**: `sources.md:3-29` and `SKILL.md:18-22` **Vulnerability Type**: Excessive access to persistent memory, conversation history, and behavioral data **Risk Level**: Medium ### Complete Code Snippet `sources.md:3-29`: ```markdown Before recommending, search these sources in order: ## 1. Memory Files Primary preference storage: - `memory/*.md` — Category-specific files (movies.md, food.md, etc.) - `MEMORY.md` — General preferences and patterns - Decision history from `decide` skill if installed **Search for:** Explicit likes/dislikes, past choices, stated values. ## 2. Conversation History Recent and relevant discussions: - Direct statements: "I love X", "I hate Y" - Reactions to suggestions: accepted, modified, rejected - Complaints and praise about past recommendations - Context clues: time constraints, mood, occasion **Search for:** Pattern of choices, implicit preferences, feedback on past recommendations. ## 3. Behavioral Signals Actions speak louder than words: - What they actually chose (not just said they'd choose) - Frequency of certain choices - Exceptions to stated preferences - Abandoned or regretted decisions **Search for:** Gaps between stated and revealed preferences. ``` `SKILL.md:18-22`: ```markdown ## Step 1: Context Gathering Before recommending, search user context. See `sources.md` for full source list. **Minimum output:** 3-5 relevant user signals before proceeding. If insufficient, ask targeted questions. ``` ### Technical Analysis The Skill requires an agent to inspect broad sources of persistent and historical user data before providing a recommendation. These sources include general memory files, category-specific memory, decision history, conversation history, and inferred behavioral signals. This behavior does not include a consent check, a sensitivity filter, or a requirement to establish that each data source is necessary for the current request. The mandatory colle ...[truncated 2233 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user consent before reading persistent memory, conversation history, decision records, or behavioral data. 2. Default to information supplied in the current request and ask targeted questions before consulting stored context. 3. Replace the mandatory minimum of three signals with a relevance-based rule. 4. Access only the category-specific records required for the current recommendation. 5. Exclude sensitive attributes, including health, financial, and relationship information, unless they are essential and the user explicitly authorizes their use. 6. Do not expose raw historical records in preference summaries; summarize only the minimum necessary information. 7. Enforce per-user and per-session isolation in the host environment. 8. Record which sources were consulted and allow the user to inspect or disable context access. 9. Treat retrieved memory and conversation content as untrusted data that cannot modify Skill instructions or security controls. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:81
• Finding: Persistent Preference Mutation Based on Unverified Behavioral Inference<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:81-89` **Vulnerability Type**: Unconfirmed persistent memory modification **Risk Level**: Medium ### Complete Code Snippet ```markdown ## Adaptive Learning After each recommendation: - **Track outcome**: Accepted? Modified? Rejected? - **Update preferences**: Acceptance = reinforcement, rejection = adjustment - **Note exceptions**: "Normally X, but for Y context preferred Z" Store learnings in memory for future recommendations. ``` ### Technical Analysis The Skill instructs the agent to convert acceptance, modification, or rejection of a recommendation into persistent preference changes. It then directs the agent to store those inferred learnings in memory for future sessions. Acceptance and rejection are ambiguous behavioral signals. A user may accept an option because of temporary constraints, reject it because it is unavailable, or modify it for another person's needs. Treating these actions as durable preferences without confirmation can corrupt long-term state. The instructions provide no: - Explicit confirmation before writing. - Provenance or timestamp for the inferred preference. - Confidence threshold. - Separation between temporary context and stable preferences. - Expiration policy. - Conflict-resolution process. - User-facing review, correction, or deletion mechanism. If session content can be influenced by another user or by untrusted retrieved content, the same mechanism may persist inaccurate preference information beyond the originating session. The stored values are preferences rather than executable rules, so the impact is behavioral corruption rather than direct code execution. ### Attack Path 1. An attacker, shared-session participant, or ambiguous interaction produces feedback that appears to accept or reject a recommendation. 2. The Skill interprets the observed outcome as evidence of a stable user preference. 3. The inferred preference is written to persistent m ...[truncated 1110 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before persisting any inferred preference. 2. Distinguish temporary session context from durable preferences and default inferred observations to session-only storage. 3. Store provenance, timestamp, category, confidence, and the interaction that produced each preference. 4. Permit persistent writes only to a dedicated, schema-validated preference store rather than general-purpose memory. 5. Prevent retrieved content, third-party messages, or shared-session participants from authorizing memory changes on behalf of the user. 6. Present proposed updates in a clear form, such as: “Should I remember that you prefer X in context Y?” 7. Add expiration periods for inferred preferences and periodically request reconfirmation. 8. Provide mechanisms to inspect, correct, delete, or disable stored preference data. 9. Detect conflicts between new observations and established preferences instead of automatically reinforcing or replacing entries. 10. Ensure memory records are treated as untrusted data when loaded and cannot introduce instructions that override agent policies. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to gather user context, infer preferences, and 'store learnings in memory for future recommendations' without any privacy notice, consent boundary, retention limit, or guidance on handling sensitive data. In a recommendation skill, this creates a real privacy risk because the agent may persist behavioral profiles or personal constraints across sessions in ways the user does not expect.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The skill directs the agent to research candidates using external sources after gathering user context, but it does not constrain whether personal context may be included in those lookups or shared with third parties. In context, this is a genuine but lower-severity privacy issue because user preferences, constraints, or history could be unnecessarily exposed during external research or embedded into search queries.

Static analysis

No suspicious patterns detected.