Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `build.mjs` (copy from `scripts/build-values.mjs` if missing)
Security audit
Values
Security checks for vulnerabilities and agentic risk
Overview
This skill is coherent and not malicious, but it stores sensitive personal values and full interview transcripts automatically, with broad activation triggers and limited upfront consent.
Install only if you are comfortable with personal values interviews being saved locally in cards, transcripts, and a generated VALUES.md file that other agents may consult. Before using it, consider setting a dedicated AGENT_VALUES_DIR, reviewing generated cards and transcripts, and deleting or editing anything too private.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description says to run the interview when the user expresses a strong feeling, a goal, a norm, or a difficult choice, which overlaps with many ordinary conversations. Although it adds some qualifiers, it does not provide a narrow trigger list or concrete exclusion examples, making activation scope broad for a markdown/manifest file.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The skill is explicitly designed to persist elicited values into a long-lived store, and later instructions also save full transcripts. Session persistence is not inherently malicious here, but it creates privacy and retention risk because the content concerns personal values, norms, and obstacles, which are sensitive and may influence future agent behavior.
- Content
md # Values Elicitation Help the user articulate a "source of meaning" — a way of living they find intrinsically meaningful — and write it as a values card in their values store. ## When to run
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger conditions are broad enough to match ordinary emotional or reflective conversation, and the guidance says to run when the user signals openness, with 'When in doubt, ask once.' In context, this can lead to the skill being invoked in sensitive moments without clear informed consent, especially because the skill later persists values cards and transcripts to disk.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The instruction to proceed 'without asking for confirmation' authorizes the agent to generate filenames, write files, and rebuild an index autonomously after a sensitive interview. In this context, the danger is not arbitrary autonomy but committing sensitive user-derived content to persistent storage without a final review checkpoint.
- Content
md ## Output After Stage 3 (the blocker question), without asking for confirmation: 1. **Pick a slug.** Kebab-cased title. "Tending the Quiet" → `tending-the-quiet`. 2. **Write the card** to `cards/<slug>.md` using the format in `references/cards.md`.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill writes both a values card and a plain-markdown transcript of the conversation to persistent storage, but the instructions do not require an upfront warning before eliciting sensitive personal content. Because the interview explicitly targets meaning, norms, difficult choices, and blockers, the stored data is likely to be highly sensitive and users may not realize it will be retained.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
The instruction to avoid showing some generated content in chat while still writing it into a persisted card creates a session-persistence risk: sensitive inferences or personal details may be stored without being explicitly surfaced to the user at the moment of creation. In a values-elicitation skill, this is more dangerous because the content is likely to contain intimate beliefs, emotionally charged experiences, and blockers that may exceed what the user expects to be retained long-term.
- Content
md likely misreadings — if "tending the quiet" could be confused with sentimentality, name that and rule it out. No abstract or ideological language; no "I value X" framings. **Don't show this prose in chat.** Write it into the card; the user can read it there if they want to. - **what I pay attention to** — 3-6 attention policies in the user's voice, formatted per the rules above. - **what gets in the way** — lightly cleaned-up version of the blocker
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs the agent to write a values card, write a transcript, and rebuild VALUES.md without requiring a clear user-facing confirmation immediately before modifying local state. In an agentic environment, implicit file writes can create unintended persistence of sensitive conversation content and may surprise users who did not realize their chat would be stored or indexed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This script aggregates highly sensitive value-card content into a single predictable file on disk, which increases exposure through backups, indexing, accidental sharing, or other local consumers. Although the generated file contains a brief 'Do not edit directly' note, it does not clearly warn that it persists sensitive personal data, and the skill context makes that data especially privacy-sensitive because it captures intimate beliefs, tradeoffs, and sources of meaning.
- Content
Static analysis
No suspicious patterns detected.