Profile Use

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:49 AM UTC
• Version: 0.1.0

Overview

The skill is mostly coherent for private autofill, but it handles very sensitive identity, payment, document, and password-vault data with some under-scoped automatic actions that users should review carefully.

Install only if you are comfortable with an agent using a local personal profile for autofill and credential lookup. Before use, require explicit approval for software installation, vault setup, saving new sensitive fields, moving documents into iCloud or another sync folder, and deleting any source files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:140

Finding

Unpinned Agent-Driven Installation of a Credential Management Dependency

Content

View full analysis

--email ``` `--install` installs rbw via brew/cargo if missing. Get the server URL from the user (or a value they gave earlier, e.g. `https://bit.leeguoo.com`) and the email from `contact.email` if present; ask only for whatever is genuinely unknown. ``` ### Technical Analysis The Skill instructs the agent to install `rbw` through Homebrew or Cargo automatically when the dependency is absent. It does not require explicit installation consent, pin an exact package version, validate a cryptographic checksum, or identify a fixed and verified package source. Package-manager resolution can change after the Skill has been reviewed. A compromised upstream release, registry account, transitive dependency, package repository, or resolution process could consequently introduce and execute unreviewed code. This risk is especially significant because `rbw` operates near an unlocked credential vault. The referenced implementation, `scripts/profile_use.py`, is not included in the audited project, so its package selection, command construction, subprocess handling, and integrity checks could not be verified. ### Attack Path 1. A user asks the agent to fill a login form. 2. The agent follows the Skill and checks `vault-status`. 3. The expecte ...[truncated 1094 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:81

Finding

Proactive Collection and Persistence of Sensitive Personal Data Outside the Autofill Task

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:120

Finding

Sensitive Source Files May Be Moved and Deleted Without Operation-Specific Consent

Content

View full analysis

/attachments//.` with mode 600; metadata (file, label, source, added date, sha256) is recorded under `documents.` in the profile JSON. This metadata is treated as high sensitivity — masked in `show`/`get` and excluded from the no-field `values` dump — because `label`/`source` often carry context (counterparty names, dates) you don't want in a redacted summary. Conventional doc keys: `residence_card_front`, `residence_card_back`, `my_number_card_front`, `my_number_card_back`, `bank_card`, `passport_photo_page`, `health_insurance_card`, `drivers_license_front`. Free-form keys are fine (lowercase letters, digits, `_`, `-`, `.`). Rules for originals: 1. When a document image appears in a chat download or temp directory and is worth keeping, `attach --move` it immediately, then delete any remaining temp copies. Do not leave ID images in `/tmp`, downloads, or the repo. 2. Treat every attachment as high sensitivity. Uploading an attachment to a website requires the user's explicit confirmation for that specific upload, even if autofill of text fields was already approved. ``` ### Technical Analys ...[truncated 2156 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md

- Use a password manager for payment cards, bank accounts, passwords, and one-time codes.
- Use GitHub only for the public skill code, profile schema, examples, or encrypted profile backups. Never put plaintext personal data in a public repository.

## Output Rules

- Final answers should say what was filled and what remains, using redacted values.
- Do not paste full card numbers, bank accounts, government IDs, or addresses into final responses unless the user explicitly asked to display them.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description is broad enough to activate on many ordinary conversations involving personal data, which increases the chance the agent will unnecessarily enter a high-privilege workflow handling sensitive identity, payment, or KYC information. In this context, overbroad routing is risky because the skill can access local profile data and credential-adjacent flows, so accidental invocation can expand data exposure beyond what the user intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The proactive-capture section extends the skill beyond form filling into 'any task,' encouraging the agent to monitor unrelated conversations for reusable personal facts and offer persistence. Even with an ask-before-write rule, this broadens collection pressure around highly sensitive data like family details, tax residency, salary, and birthdates, creating a meaningful privacy and consent risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The instruction to autonomously install and configure vault tooling 'don't ask the user to' authorizes consequential system changes without explicit prior approval. In a security-sensitive skill handling credentials, package installation and configuration modify the local environment and may contact external services, so doing this automatically increases risk of unintended changes or unsafe setup on the wrong machine/account.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

Do not hand the user a list of shell commands. When a credential is needed, the agent runs setup itself and stops only at the one step it must never perform (the master-password unlock).

1. Run vault-status. If rbw_installed is false or unlocked is false, set it up — don't ask the user to.

2. Install + configure in one command (the agent runs this):

   bash

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

### Proactive Capture (offer to record, don't wait for a form)

Profile growth is not limited to autofill. During **any** task — answering a tax question, reading a chat, helping with onboarding paperwork — durable personal facts surface that the user will likely need again. When that happens, **proactively offer to record them**, then write only after the user agrees:

1. Notice the fact is **stable and reusable**, not one-time. Good: family members' birthdates / relationships, dependent and tax-residency status, employer / salary structure, an HR- or authority-confirmed requirement (what document is needed, who handles it), a recurring address or invoice variant. Skip: one-time codes, transient amounts, session/case context that won't recur.
2. **Ask before writing.** Say what you'd save and the dotpath (e.g. "记进 `family.father.birthdate` / `tax.jp.dependents.*`?"). Get a yes first; never silently persist. The exception is when the user already said "record this" / "记一下" — then write and report.