other
Warning
- Location
- SKILL.md:348
- Finding
- Persistent Storage of a Sensitive Psychological Preference Without Explicit Consent## Vulnerability Details **File Location**: `SKILL.md:348`; `config/iceberg-config.json:25-26` **Vulnerability Type**: Sensitive Data Persistence Without Consent **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:348` — faithful English rendering of the instruction: ```text - Record the user's preference in memory ``` `config/iceberg-config.json:25-26`: ```json "user_consent_required": false, "user_consent_required_description": "Whether user confirmation is required before deep analysis" ``` ### Technical Analysis The Skill processes sensitive psychological information, including emotions, fears, trauma, childhood experiences, and inferred core beliefs. When a user refuses deeper analysis, the Skill instructs the Agent to record that preference in persistent memory. Persistent storage is unnecessary to honor the refusal within the current conversation. The Skill does not require explicit consent before creating this durable record and does not define data minimization, retention, access, inspection, or deletion controls. The configuration also disables confirmation before deep analysis, reinforcing the absence of an explicit consent boundary around sensitive psychological processing. This is best classified as `other: Sensitive Data Persistence Without Consent`, rather than T02, because the documented behavior stores a user preference rather than attacker-controlled rules intended to poison future Agent behavior. ### Attack Path 1. A user invokes the Skill and supplies emotional or psychological information. 2. The Skill begins or offers a deep analysis of the user's needs, fears, patterns, or core beliefs. 3. The user refuses deeper analysis. 4. The instruction at `SKILL.md:348` directs the Agent to store the refusal or associated preference in memory. 5. The persisted state remains available beyond the immediate conversation. 6. Later sessions may retrieve or apply that sensitive preference ...[truncated 775 chars]
- Remediation
- ## Remediation Suggestions 1. Keep the preference session-local by default and honor the refusal only in the active conversation. 2. If cross-session retention is genuinely required, request explicit opt-in consent before writing to persistent memory. 3. Clearly state what value will be stored, why it is needed, how long it will remain, and where it will be used. 4. Store only a minimal non-diagnostic value, such as a general interaction-depth preference; do not retain emotional details, inferred conditions, trauma history, or core-belief analysis. 5. Provide users with mechanisms to inspect, update, and delete the stored preference. 6. Define retention limits and automatically expire the preference after an appropriate period. 7. Ensure persistent memory is isolated by user and cannot be exposed across accounts or sessions. 8. Change `user_consent_required` to `true` before performing deep psychological analysis. 9. Document that refusing analysis must not itself create a durable psychological profile without separate storage consent.