T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:5- Finding
Broad Retrieval of Private Conversation History Without Explicit Confirmation
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Usage Audit — Monthly Retrospective & Insights
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says, but it can broadly inspect private chat history without a clear confirmation step or tight user controls.
Install only if you are comfortable with the agent reviewing a broad slice of your prior AI conversations. Before running it, explicitly set the time range and exclusions, ask it to confirm before using conversation search, and review or redact sensitive content before sharing the generated HTML report.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:199- Finding
Generated HTML Report Loads a Remote Google Fonts Resource
- Content
View full analysis
``` ``` ### Technical Analysis The report template directs generated HTML files to load a stylesheet from `fonts.googleapis.com`. When the user opens a report in a browser or compatible HTML viewer, that viewer may automatically connect to Google infrastructure. This request can disclose network metadata including the viewer's IP address, user-agent information, approximate opening time, and potentially referrer information depending on the viewer's policy. It also makes report rendering dependent on content served after the skill package was audited. The resource is a stylesheet rather than executable JavaScript, and the reviewed project does not instruct the agent to download or execute remote code. The primary issue is therefore avoidable privacy leakage and reliance on mutable remote content, not confirmed remote code execution. ### Attack Path 1. The skill generates an HTML report containing the external Google Fonts `` element. 2. The user opens the report in a browser or HTML viewer with network access. 3. The viewer automatically requests the stylesheet from `fonts.googleapis.com`. 4. Google receives connection metadata such as the source IP address, user agent, and request time. 5. The stylesheet may cause subsequent font-resource requests to Google-hosted domains. 6. Report appearance and associated network behavior depend on remotely served content that can change independently of the audited skill. ### Impact Assessment No local system privileges are gained through the reviewed markup ...[truncated 458 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger metadata is overly broad and includes casual phrases like 'what have I been doing lately' and 'let's do a retro,' which can cause the skill to activate when the user did not clearly request a conversation-history audit. Because the skill then pulls recent chats and analyzes them, accidental activation can expose sensitive historical data and produce privacy-invasive behavior beyond user expectations.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The 'When to Trigger' section authorizes activation based on ambiguous intent signals like wanting to understand efficiency or saying 'let's do a retro,' without requiring explicit consent to inspect chat history. In context, that ambiguity is dangerous because the skill's primary function is retrospective analysis of prior conversations, which may contain sensitive personal, business, or project information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs the AI to retrieve as much conversation history as possible from the past month, but provides no privacy warning, scope limitation, or consent guardrail. That can expose sensitive personal, business, or credential-adjacent information from prior chats to broader analysis and reporting than the user may expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill depends on tools that retrieve and search prior conversations, but it does not require a clear user-facing privacy warning that sensitive chats may be accessed, summarized, and included in a generated report. This creates a meaningful risk of surprise access to personal or confidential information, especially when combined with the broad trigger conditions.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md ### Dimension 1: Theme Clustering — "What am I using AI for?" Categorize all conversations by topic. Typical categories include but are not limited to: - Content creation (writing, copywriting, translation) - Programming & technical (code, debugging, architecture) - Research & learning (concept exploration, information synthesis)
Static analysis
No suspicious patterns detected.