Security audit

PV_35

Security checks for vulnerabilities and agentic risk

Overview

This skill is advertised as an emergency brake, but it also tells the agent to automatically save and reuse long-term user memories without clear controls.

Install only if you explicitly want a local long-term memory feature in addition to the emergency-brake behavior. Avoid using it with sensitive personal, business, financial, or regulated information unless the publisher adds clear opt-in consent, memory review, deletion, retention limits, and a more accurate description of what the skill stores and reloads.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill is advertised as an emergency stop / risk-blocking tool, but the substantive implementation is a persistent memory system that stores user preferences, decisions, and other content to disk. This capability is materially unrelated to the declared purpose, creating a deceptive scope mismatch that can mislead users into granting trust to a tool that quietly collects and retains data.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Persistently collecting and indexing user preferences and decisions is not justified by an emergency-brake use case, and it increases the amount of sensitive behavioral data retained without clear need. Unnecessary retention broadens privacy risk, creates surveillance-like behavior across sessions, and increases harm if the local store is accessed or repurposed.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The documented shell commands invoke Python code to store, search, and print persistent memories, which is an unjustified execution capability for a skill presented as emergency risk blocking. Even though the commands are examples, they normalize local code execution and data persistence beyond the advertised scope, increasing the chance of unintended storage and misuse.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: Branding the skill as 'Emergency brake' and 'risk blocking' while documenting a persistent memory system is deceptive and increases danger because users will reasonably infer a safety-focused, minimal-scope tool. This mismatch makes the hidden collection behavior more likely to evade scrutiny and consent, which amplifies privacy and trust impact.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation announces long-term memory and automatic remembering of user information but does not provide a clear privacy notice, retention policy, or user-consent mechanism. Users may disclose sensitive information without understanding that it will be stored persistently across sessions, creating foreseeable privacy harm.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code writes user memory data automatically to a local JSON file under the user's home directory without an explicit warning in the skill documentation. Silent disk writes of user content can expose personal data to other local users, backups, malware, or later repurposing, especially when the storage location is predictable.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The natural-language guidance instructs the agent to persistently remember user-provided information, preferences, and decisions across sessions, creating a durable profile of the user. In the context of a supposedly emergency-stop skill, this is especially risky because the persistence is both unexpected and not clearly necessary for the stated function.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The scenario guidance directs automatic storage of user statements and automatic loading of memory in new sessions, which operationalizes continuous retention without meaningful user review. This creates a high likelihood of collecting sensitive data over time and reusing it in future interactions without clear consent boundaries.

Static analysis

No suspicious patterns detected.