Security audit

论语 — 私人语录

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed personal quote-journal skill that stores user-approved entries locally, with some privacy risks users should understand before saving sensitive thoughts.

Install only if you want a local, persistent personal quote archive. Avoid saving passwords, private third-party statements, financial/health details, or intimate content unless you are comfortable with it being stored in plaintext under ~/.hermes/lunyu/ and possibly exported or resurfaced by daily/random features. Review entries before exporting or enabling any scheduled daily push.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README encourages capturing spontaneous personal thoughts and exporting them, but it does not warn users that these entries may contain sensitive personal data, intimate content, or other private material. Because the skill stores data on disk and supports export, users may unknowingly create a durable, searchable archive of sensitive content that could later be exposed through device compromise, syncing, sharing, or accidental publication.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The core behavior of the skill is to persist user-provided quotes and associated context for later retrieval. Storing free-form speech plus situational context creates a risk of capturing secrets, intimate details, or other sensitive information in plain text, especially because the content is framed as spontaneous inspiration.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Several active triggers are short natural-language phrases such as '把这句话记下来' and '这句记进论语' that may overlap with ordinary chat. Ambiguous trigger phrases can cause accidental activation and unintended storage of nearby user content or context.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The passive capture flow expands collection beyond explicit save commands by prompting to store memorable statements from ordinary conversation. Even with confirmation, this broadens the surveillance surface and may pressure users into saving content they did not initially mean to persist, including sensitive remarks made in casual context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The passive trigger is defined broadly as any statement that seems 'powerful/witty/wise,' then asks for confirmation to save it. This can cause frequent unsolicited capture prompts during normal conversation and increases the chance that sensitive content is surfaced and persisted when the user did not intend to use the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill specifies automatic local file writes and later scheduled processing, but does not provide prominent notice about retention, visibility, sensitivity of stored content, or user control over deletion/export behavior. Because the data includes personal utterances and context, lack of privacy disclosure can lead to unintentional collection and retention of sensitive information.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The storage schema includes raw text, timestamp, tags, chapter, and especially 'context' describing the scene in plain language. This metadata can materially increase sensitivity by linking quotes to personal situations, relationships, routines, emotions, or events, making disclosure more harmful than storing the quote alone.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The daily compilation and 'today's quote' push features can resurface previously captured private content without fresh contextual review. Re-exposure increases the chance of shoulder-surfing, notification leakage, or accidental display of intimate or sensitive remarks at inappropriate times.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill's natural-language instructions, commands, and usage guidance are presented only in Chinese, which can amount to a language policy violation when no user opt-in or explicit locale limitation is stated. There is no indication that the skill is intentionally region-specific or that alternative language support is unavailable by design.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.