other
Warning
- Location
references/recording-rules.md:11- Finding
Automatic Persistent Storage of Full Conversations Without Explicit Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
my study pal
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent study assistant, but it automatically saves detailed conversations and profile data without clear consent or deletion controls.
Install only if you are comfortable with the skill creating a mystudy folder in each workspace and saving study topics, profile/preferences, and full conversation records by default. Avoid using it with secrets, confidential work details, health/financial information, or anything you would not want stored locally; review and clean mystudy regularly if installed.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T02 · Agent Memory Poisoning
Warning
- Location
scripts/refresh_runtime_profile.py:37- Finding
User-Controlled Preferences Become Persistent Agent Instructions Without Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose presents the skill primarily as a concept-explanation assistant, but the instructions heavily emphasize local file initialization, profile reads, and persistent record updates. That mismatch can mislead users and operators about what the skill actually does, causing them to grant trust or access they would not have granted had the persistence and file-manipulation behavior been made explicit.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill clearly instructs file reads and writes under
mystudy/, but it does not declare any explicit tool scope or permissions boundary. This creates a governance gap: reviewers and runtime policy systems cannot easily verify or constrain filesystem access, increasing the risk of unintended data access or persistence beyond user expectations.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description explicitly defines the skill as a Chinese concept-explanation companion and does not mention any user opt-in, language selection, or region-specific justification. Under the policy, a fixed language constraint is a violation unless the skill offers a choice or clearly documents why the locale limitation is required.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill is designed to maintain study summaries, detailed records, and user profiles, but it does not provide a clear upfront warning that user content may be persistently stored. This undermines informed consent and can lead to retention of sensitive educational, personal, or preference data that the user did not realize would be written to disk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation rules allow the skill to trigger not only on explicit
mspinvocation but also on broad classes of ordinary concept questions. In a general assistant environment, this can cause the skill to run unexpectedly, leading to unintended file reads/writes and silent profile updates during normal conversation.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs broad persistent logging of user-provided content, dialogue, long-term preferences, and derived runtime profile data. In an education context, these records can accumulate sensitive personal information, and the broad natural-language logging rules increase the chance of over-collection, retention of unnecessary content, and privacy harm if the files are accessed by others.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The short description states the skill is a '中文概念解释搭子', and the default prompt is entirely in Chinese, indicating the skill is designed to operate in a specific language without offering a user choice. This creates a language policy concern because the file does not document opt-in, alternative language support, or a justified locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The document title and all behavioral defaults are specified only in Chinese, and the file presents them as the active runtime profile rather than an optional locale setting. This creates a natural-language locale constraint without any visible user opt-in or documented justification for a China-specific context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file is entirely written in Chinese and defines user teaching and language-style preferences in Chinese, but it does not state that the user opted into Chinese or that the skill is limited to a Chinese-language context. Per the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The blueprint explicitly defines the skill as a Chinese-language companion for concept explanation, which can cause the agent to respond in Chinese by default even when the user has not opted in. This is a policy and usability risk because it may override user language preference, reduce accessibility, and create unsafe misunderstandings for users who cannot accurately read the output.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file is written as a normative instruction set for the skill's response method and presents the behavior entirely in Chinese, describing it as the defined answering mode for
my-study-pal. There is no indication that users may choose another language or that the Chinese-only behavior is required for a region-specific or compliance reason, which creates a language/locale policy concern.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill specification is written as a Chinese-only response method and repeatedly defines output style in Chinese, but nowhere indicates that users may opt into another language or locale. Under the policy, a skill that effectively forces a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Line L67 states that the mode should read and apply an existing language-style configuration, but the document does not mention giving the user a language or locale choice in this file. Because the policy requires avoiding forced language/locale behavior without opt-in, this is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The entire skill specification is written to define the response method in Chinese and includes no indication that the user may choose another language or that Chinese-only behavior is region-specific and intentional. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The file title and all instructional content are written entirely in Chinese, and the method definition appears to prescribe a Chinese-language interaction style by default. There is no explicit statement that the user may choose another language or that this locale constraint is limited to a justified region-specific use case.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file is written entirely in Chinese and defines the response method in Chinese, including example trigger phrases and operational guidance, with no indication that users may choose another language. This creates a natural-language locale policy concern because it appears to constrain interaction language without opt-in or justification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The rules mandate persistent storage for nearly every substantive concept-explanation exchange and also direct maintenance of long-term user profile data. That exceeds the minimum necessary behavior for a concept-explainer skill and creates avoidable privacy and data-retention risk, especially because users may disclose sensitive work, education, or personal learning information during tutoring-style conversations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill requires persistent storage of learning records and user profile data without any explicit user-facing notice or consent flow. In a tutoring context, users are likely to share personal background, work domain, and preferences, so silent storage materially increases privacy and trust risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Broad instructions to retain full user/assistant conversations and maintain user profile details create a semantic data-retention risk: the system may accumulate sensitive information that can later be exposed through logs, backups, prompts, or downstream tools. Because this is an educational assistant, conversation content is likely to include personal context that is useful for teaching but risky to persist indefinitely.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file says sensitive content should be reduced to necessary summaries, but elsewhere it instructs the system to retain complete dialogue by default. That policy conflict is dangerous because implementers may follow the more concrete 'store full conversation' rule and persist sensitive personal data that should have been minimized.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to preserve the complete dialogue process creates comprehensive transcript retention without warning the user. Full transcripts can capture incidental secrets, identifiers, and sensitive learning context well beyond what is needed to continue concept explanations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file defines the skill's response contract entirely in Chinese and repeatedly specifies output behavior in Chinese-language terms, but it does not indicate that the language is optional or user-selectable. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The document is written as a Chinese-only storage and interaction specification, and the language-style preference section defines behavior in Chinese terms without indicating that users may choose another language. This can violate language/locale policy when a skill implicitly forces a specific language absent opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file explicitly instructs the skill to store full conversation records and a persistent user profile locally, but it does not require any user notice, consent flow, minimization rule, or retention/deletion policy. Even in a study assistant context, collecting full transcripts plus preference/profile data creates a privacy risk because sensitive personal, professional, or behavioral information can accumulate over time without clear boundaries.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Requiring complete preservation of dialogue history creates a natural-language instruction for persistent collection of potentially sensitive user data. In combination with concept tutoring, users may disclose work context, interests, misunderstandings, or personal learning needs, and the spec provides no minimization or filtering before persistence.
- Content