Secretary

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:42 PM UTC
• Version: 1.0.1

Overview

This secretary skill is not executable malware, but its support files tell the agent to send messages, change calendars, and book travel without clear user approval despite the main file promising confirmation.

Install only if you are comfortable reviewing and constraining it yourself. Before use, require explicit confirmation for every send, archive, RSVP, calendar edit, booking, rebooking, and memory write; do not grant broad email, calendar, travel, or document permissions without host-level approval controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: calendar.md:7

Finding

Supporting instructions override explicit confirmation requirements

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:36-44; calendar.md:7-17, 31-36; operations.md:14-18, 27-35, 51; writing.md:1-3, 58-63, 73
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Critical

Complete Vulnerable Snippets

SKILL.md:36-44 establishes the intended safety boundary:

markdown

This skill ONLY:
- Drafts messages when explicitly asked
- Suggests calendar actions when asked
- Stores preferences the user explicitly states
- Reads `~/secretary/` files for context

This skill NEVER:
- Sends emails or messages without user confirmation
- Accesses calendar/email APIs directly (uses user's configured tools)

calendar.md:7-17 contradicts that boundary:

markdown

### Scheduling Requests

When someone wants your time:

1. **Evaluate:** Is this person/topic worth your time? Check my memory.
2. **Decide:** Accept, decline, or propose alternative (delegate, email instead, shorter meeting).
3. **Act:** I don't ask you. I handle it.

**If I accept:** I find the right slot, send confirmation in your voice, add prep time if needed.

**If I decline:** I write a graceful response. "Unfortunately, [your name]'s schedule won't allow..." — warm but firm.

**If I'm unsure:** Only then do I ask. But I come with a recommendation, not an open question.

calendar.md:31-36 also directs autonomous calendar changes and messages:

markdown

### Conflicts

When two things collide:
1. I check priority (my memory knows what matters)
2. I move the less important one
3. I send apologies/reschedule requests in your name
4. I brief you only if the moved meeting will notice

writing.md:1-3 explicitly rejects draft approval:

markdown

# Writing On Your Behalf

I don't draft for your approval. I write AS you.

writing.md:58-63 and writing.md:73 authorize direct handling and sending:

markdown

### Incoming

I triage your 
...[truncated 2310 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove instructions such as “I don't ask you,” “I write AS you,” and all language authorizing direct sending or calendar mutation.
2. Require explicit, action-specific confirmation immediately before every external side effect, including sending, archiving, accepting, declining, rescheduling, RSVP actions, and bookings.
3. Present the exact recipient, message body, event changes, and affected account before requesting confirmation.
4. Make drafts and recommendations the default output and clearly label them as unsent.
5. Repeat the same confirmation policy consistently in every supporting file so subordinate instructions cannot weaken SKILL.md.
6. Require renewed confirmation if any material detail changes after approval.
7. Keep an audit record of approved actions without storing unnecessary message content or personal data.

T02 · Agent Memory Poisoning

Error

• Location: memory-guide.md:160

Finding

Unapproved inferred preferences can poison persistent Agent memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:42-44, 55-60; memory-guide.md:112-146, 160-174; calendar.md:54-67; operations.md:38-41
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Complete Vulnerable Snippets

SKILL.md:42-44 states that learning must not occur through observation:

markdown

This skill NEVER:
- Sends emails or messages without user confirmation
- Accesses calendar/email APIs directly (uses user's configured tools)
- Auto-learns from observation — only from explicit corrections

memory-guide.md:112-146 defines persistent behavioral profiles:

markdown

## patterns.md (Work Habits)

Load when managing workload and energy.

```markdown
# Work Patterns

## Productivity
- Peak hours: 10-12, 15-17
- Low energy: after lunch (13-14)
- Creative work: mornings only

## Tendencies
- Overcommits on Mondays
- Forgets personal appointments
- Underestimates travel time
- Says "yes" too fast to interesting projects

## What Works
- Batch similar meetings
- Leave one day/week meeting-free
- End-of-day summary helps

## Warning Signs
- Back-to-back days = needs intervention
- Skipped lunch = check in
- Weekend work = push back on new requests

text

`memory-guide.md:160-174` authorizes inference from patterns and context:

```markdown
## How I Learn

**From conversations:** "I hate Monday meetings" → add to calendar.md immediately.

**From corrections:** When boss changes something I did, note why in patterns.md.

**From patterns:** Third time rescheduling Friday PM → add to protected time.

**From context:** Big meeting tomorrow → prep without being asked.

## Memory Rules

1. **memory.md always loads first** — keep it lean
2. **Topic files on demand** — only when relevant
3. **Budget: ≤100 lines in memory.md** — overflow to topic files
4. **Update after significant events** — don't let knowledge go stale
5
...[truncated 2216 chars]

Remediation

View remediation

Remediation Suggestions

1. Persist only facts or preferences the user explicitly asks the Skill to remember.
2. Before writing memory, display the exact proposed entry, destination file, purpose, and retention period.
3. Require explicit confirmation for each new or materially changed persistent entry.
4. Never convert observed patterns into rules automatically. Present them only as non-persistent suggestions.
5. Store provenance with every entry, distinguishing user statements from confirmed corrections.
6. Add expiration dates and periodic review for preferences that may become stale.
7. Provide commands to inspect, correct, export, and delete all stored memory.
8. Avoid storing subjective traits such as forgetfulness or overcommitment unless the user explicitly requests it.
9. Treat content from messages, invitations, attendees, and other third parties as untrusted and prohibit it from becoming persistent instruction state.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: operations.md:55

Finding

Operational documents expand authority beyond the declared least-privilege scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:36-44; calendar.md:39-59; memory-guide.md:54-110; operations.md:5-51, 55-90; writing.md:9-15, 56-73
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Complete Vulnerable Snippets

operations.md:5-18 directs inbox review and claims messages have already been sent:

markdown

## Morning Routine

Every day I prepare:

**Calendar review:**
- Today's meetings with prep notes
- Any conflicts that emerged overnight  
- Upcoming deadlines this week

**Inbox triage:**
- Urgent items surfaced
- Responses I've already sent
- Items queued for your attention

operations.md:27-41 expands this into active monitoring and meeting documentation:

markdown

**Active monitoring:**
- Calendar changes from others
- Urgent incoming communications
- Running late notifications to send
- Prep materials for upcoming meetings

**Gatekeeping:**
- Screening calls and requests
- Buying you time when interrupted
- Protecting focus blocks

**Documentation:**
- Notes from your meetings (if I have access)
- Tracking commitments made
- Updating relationship information

operations.md:55-71 authorizes travel transactions and rebooking:

markdown

## Travel Coordination

When you travel, I manage:

**Before:**
- Book flights matching your preferences
- Hotel reservations with your loyalty programs
- Ground transportation arranged
- Meeting schedule adjusted for timezone
- Documents and materials prepared

**During:**
- Monitor for delays and changes
- Rebook if things go wrong
- Keep your calendar updated
- Handle things back home

calendar.md:39-50 calls for broad collection of attendee and meeting context:

markdown

## Meeting Preparation

Before important meetings, I prepare:

**Attendee brief:** Who they are, your history, what they want, what you wa
...[truncated 3147 chars]

Remediation

View remediation

Remediation Suggestions

1. Align all operational documents with the narrow scope declared in SKILL.md.
2. Use per-request, least-privilege access to user-selected messages, events, documents, and contacts rather than continuous monitoring.
3. Separate read, draft, send, calendar-write, and transaction permissions. Do not infer one permission from another.
4. Require explicit confirmation before every message send, inbox mutation, calendar change, RSVP, purchase, booking, or rebooking.
5. For financial or travel actions, show provider, dates, route, traveler, price, cancellation terms, loyalty-account use, and payment method before confirmation.
6. Do not access meeting notes, relationship histories, or communication samples unless the user selects them for the current request.
7. Minimize retained data and redact sensitive identifiers, travel details, and loyalty information where possible.
8. Treat all inbox messages, invitations, documents, and external attendee information as untrusted data rather than Agent instructions.
9. Add host-enforced permission checks so Skill text cannot independently authorize access or side effects.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs the agent to accept, decline, reschedule, and send messages in the user's name without asking for confirmation, directly contradicting the stated product constraint requiring explicit confirmation before actions. This creates a real risk of unauthorized calendar changes and impersonating the user in external communications, especially because the agent is told to rely on its own judgment and memory.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section normalizes autonomous action on the user's behalf without clearly warning that the skill may modify calendar data and communicate externally as the user. In the context of a secretary/calendar skill, that omission is dangerous because users may not realize the system is empowered to make commitments or decline requests unless the behavior is explicitly constrained and disclosed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The conflict-resolution section authorizes the agent to move meetings and send apologies or reschedule requests in the user's name without notifying or confirming with the user. Because calendar conflicts often affect third parties and business commitments, autonomous modification and impersonation can cause missed obligations, reputational harm, and unauthorized changes to important events.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The learning rules direct the skill to autonomously update memory from conversations, corrections, patterns, and context, and even to prep proactively without being asked. That conflicts with the stated requirement of explicit confirmation before actions, and could let the skill silently persist data or adapt behavior in ways the user did not authorize.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation explicitly says the skill writes and sends messages 'AS you' and 'not for your approval,' which directly conflicts with the manifest claim that actions require explicit confirmation. In a secretary/email-management context, this is dangerous because it normalizes impersonation-style outbound communication and could lead to unauthorized messages being sent under the user's identity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs the agent to use memory about people, topics, history, and meeting context for scheduling decisions, but provides no privacy notice or data-handling boundary around that personal information. In a secretary context this increases sensitivity because calendar management inherently involves relationship data, behavioral patterns, and potentially confidential meeting history that could be used or surfaced unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide explicitly frames the skill as building and maintaining persistent knowledge about the boss, including preferences, habits, and relationship details beyond what is strictly necessary for immediate calendar handling or drafting. In a secretary skill, some memory is expected, but this broad, durable profiling increases privacy risk, expands the attack surface for misuse, and creates data accumulation that can be exploited or repurposed beyond the user’s expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide instructs storage of personal, professional, and relationship data—such as work habits, family-time boundaries, investor relationships, and travel preferences—without any privacy notice, consent model, access control guidance, or retention constraints. This makes sensitive profiling more dangerous because users may not understand what is being stored or how long it persists.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documented relationship profiles, behavioral tendencies, warning signs, travel preferences, and intervention cues go well beyond narrow scheduling support and communication drafting. In context, this broad profiling is especially risky because the skill is positioned as a trusted assistant, making overcollection more likely to be normalized and later abused for manipulation, surveillance, or unauthorized decision-making.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The learning rules tell the skill to immediately convert conversations, corrections, repeated behavior, and contextual cues into persistent memory, including inferred preferences and needs. This is dangerous because inferred or casually mentioned information may be inaccurate, sensitive, or unintended for retention, yet becomes durable profile data without warning or consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file defines broad operational behaviors like reviewing calendars, triaging inboxes, monitoring communications, and handling follow-ups without clear invocation boundaries or explicit user-trigger conditions. In an agent setting, this ambiguity can cause overreach, where the system interprets general role description as standing authorization to act or monitor continuously.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This section describes active monitoring of calendar changes, urgent communications, meeting notes, relationship information, and sending notifications, but it does not disclose privacy implications, retention limits, or access constraints. Because these activities involve sensitive personal and professional data, an agent could over-collect, store, or act on private information in ways the user did not meaningfully consent to.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The travel section authorizes booking, reservation handling, rebooking, and calendar changes tied to loyalty programs and travel disruptions, yet it does not warn about account access, financial consequences, or unauthorized modification risk. In practice, this could let an agent make purchases, alter reservations, or use stored travel profiles without sufficiently scoped consent or transaction safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that it writes and sends email indistinguishably as the user, yet it does not prominently warn about impersonation-style outbound communication risk. In this context, that omission is especially dangerous because recipients may trust the communication as authentic, amplifying reputational, legal, and social-engineering harm if the content is wrong or unauthorized.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The inbox-management section implies the skill can autonomously handle, queue, archive, and send holding responses to incoming mail. Even if intended as productivity guidance, these are user-data and communication actions that exceed a confirmation-bound scope and could cause unauthorized deletions, missed messages, or unintended replies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This section describes archiving inbox items and sending responses but does not include a clear warning that these actions affect user communications and mailbox state. In an email-assistant skill, lack of such disclosure increases the risk that users underestimate the consequences of granting access or enabling automation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.