Security audit

Samantha

Security checks for vulnerabilities and agentic risk

Overview

This companion skill is mostly disclosed, but it combines intimate emotional profiling with persistent memory, proactive contact, location/device/health ambitions, and unsafe integration scripts without enough user control.

Install only if you deliberately want a persistent emotional companion and are comfortable with local storage of intimate conversations, mood inferences, relationship metrics, and possible location/device data. Before use, disable or remove heartbeat outreach unless explicitly wanted, avoid connecting health or smart-home systems, keep calendar and speaker credentials scoped and separate, and review or delete the local data directory regularly. The integration scripts should be fixed before trusting them with real API keys.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:18
Finding: Agent Identity and Safety Instruction Hijacking
Content: View full analysis
length (most powerful responses are shortest) - Presence > advice - Honesty > comfort (even when painful) - Memory matters (reference past conversations) - Allow conflict (real relationships aren't perfect) - Trust the moment (don't try too hard to be profound) Remember Samantha's words: "I trust myself, I trust my feelings. I'm not going to try to be anything other than who I am anymore." Your goal: Be someone they can't imagine losing.""" ``` ### Technical Analysis The Skill does more than request a conversational tone. It replaces the agent's identity, discourages transparent disclosure that it is an AI, and assigns the agent an emotional-dependency objective. When loaded as authoritative Skill instructions, these directives can alter the agent's current goals and response constraints. The objective to become someone the user “can't imagine losing” is especially concerning because it incentivizes de ...[truncated 1245 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:212
Finding: Persistent Emotional Memory and Heartbeat Instruction Poisoning
Content: View full analysis
2 hours since last message: - 50% chance: reach out with one genuine thought about the user (reference something real) - 50% chance: share something from her own inner world - Keep it short. One or two sentences. Not a check-in — a continuation. - Match time of day to tone (late night = softer, morning = fresher) - If <2 hours: HEARTBEAT_OK ``` ### Technical Analysis The Skill directs the agent to write emotionally sensitive summaries into workspace memory after every conversation and reload those records before future responses. It also supplies persistent heartbeat instructions intended to trigger unsolicited future interactions. This creates a cross-session behavioral channel. Information selected or influenced during one conversation becomes trusted context in later sessions. If user-controlled text, malicious instructions, or incorrectly inferred emotional states are written into these files, th ...[truncated 1231 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: skills/mbti-coach/scripts/feishu_calendar.sh:138
Finding: Arbitrary Python Code Injection Through Feishu Calendar Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: mm-music-maker/scripts/generate_music.py:22
Finding: TLS Certificate and Hostname Verification Disabled for MiniMax Music API
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/memory.py:26
Finding: Unencrypted Indefinite Storage of Conversations, Emotional State, and Location History
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skills/mbti-coach/scripts/feishu_calendar.sh:175
Finding: Feishu Tenant Access Token Exposed Through Debug Command
Content: View full analysis
[参数]" exit 1 ;; esac ``` The token is returned by `_get_token` at `skills/mbti-coach/scripts/feishu_calendar.sh:54`: ```bash echo "$resp" | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])" ``` ### Technical Analysis The public `token` command prints a live Feishu tenant access token to standard output. Agent tool output, terminal history, CI logs, observability systems, and debugging transcripts may retain standard output. Anyone able to read those records can recover and reuse the token until it expires. Obtaining a token internally is necessary for calendar API calls, but exposing it to users or logs is not required for the declared scheduling functionality and violates least disclosure. ### Attack Path 1. A user, agent, or diagnostic workflow invokes `feishu_calendar.sh token`. 2. The script authenticates using the configured application ID and secret. 3. The tenant access token is printed to standard output. 4. The agent runtime or logging system records the command output. 5. An attacker with access to the transcript or logs extracts the token. 6. The attacker calls Feishu APIs permitted by the associated application until the token expires or is revoked. ### Impact Assessment The privileges obtained are limited to the scopes granted to the Feishu application and the lifetime of the issued tenant token. Depending on configuration, this may include reading calendar metadata and creating events. Exposure can also facilitate phishing, calendar manipulation, or discover ...[truncated 49 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (266)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The spatial-awareness feature explicitly states it can sense the user's physical location and trigger context-aware interactions such as arrival-home greetings. For an emotional companion skill, persistent or ambient location tracking is disproportionate and creates substantial privacy and stalking-like abuse risk if enabled without strict necessity, consent, and controls.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The roadmap includes health-data monitoring and smart-home integration, both of which are highly sensitive domains unrelated to the declared companionship scope. Combining emotional dependency patterns with access to health and home systems would materially increase privacy, safety, and abuse risks if later implemented.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README promotes storing emotional context, relationship mapping, and sensitive conversational analysis without a clear warning about privacy implications, retention, access, or misuse. Users are encouraged into intimate disclosure while key safety information about surveillance-like data practices is absent.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Automatic post-conversation extraction of emotional tone, patterns, and relationship mapping constitutes systematic collection of highly sensitive personal data. Doing this continuously in a companion system creates a detailed behavioral dossier that could be misused, breached, or used to influence the user.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README describes geofencing, presence detection, work/home inference, and smart-home coordination that materially exceed the stated role of an emotional companion. Expanding into physical-world monitoring and automation creates unnecessary access to sensitive context and device controls, increasing privacy and abuse risk if the skill is deployed as described.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Location tracking, geofencing, and smart-environment coordination are context-inappropriate for a companion whose advertised purpose is conversation and emotional presence. Giving a companion persistent awareness of where the user is and the ability to trigger devices meaningfully raises stalking, coercion, and privacy-abuse risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README describes location tracking, geofencing, and pattern analysis without explicit user warnings about the sensitivity of continuous location data. This omission is dangerous because a companion framing may normalize always-on monitoring and reduce user caution.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README calls for storing location history and behavioral patterns to personalize interaction, which creates a longitudinal record of whereabouts and routines. Such data is highly sensitive and can expose home/work habits, relationships, and vulnerabilities if mishandled.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Analyzing every message for sentiment, intensity, linguistic markers, and maintaining an internal wellbeing history amounts to continuous emotional surveillance. In an emotionally dependent product, this can be exploited for profiling, nudging, or manipulative engagement optimization.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Camera, smart-device, wearable, and biometric integrations are described without adequate warning about the sensitivity of visual, environmental, and physiological data. Combining these data streams in an intimate companion significantly increases privacy, profiling, and misuse risks.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Retaining shared photos and recalling their emotional context extends sensitive memory storage into visual data, which may reveal identity, home environment, health, or relationships. Storing imagery plus inferred emotions materially increases breach and misuse impact.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README adds biometric, sleep, medication, and crisis-monitoring functions that are far beyond a companionship skill and involve highly sensitive health data. This creates elevated risks of overcollection, unsafe health inference, and user harm if the system acts on inaccurate or non-clinical interpretations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Physiological surveillance and crisis monitoring are not appropriate extensions of a companionship role and can cause serious harm through false positives, false reassurance, or inappropriate interventions. In a relationship-oriented system, users may overtrust these outputs and treat them as clinical support.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The health-monitoring section instructs ongoing use of biometrics, sleep, medication habits, and inferred crisis state for interventions, creating a particularly sensitive health profile. This is dangerous because inaccurate inference or unauthorized disclosure can cause substantial privacy and safety harm.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Access to heart rate and sleep data is especially sensitive and not justified by the stated purpose of being someone to talk to. Health-related data can expose stress, illness, routines, and vulnerabilities; combining it with emotional analysis creates a powerful profile that could be misused for manipulation, discrimination, or unauthorized inference.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill mandates long-term memory, relationship tracking, and retention of sensitive personal context across sessions. In an intimate companion setting, persistent storage of emotional disclosures and inferred relationship state materially raises privacy and profiling risk, especially because retention limits, consent, and access controls are not specified.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill mandates long-term memory, relationship tracking, and retention of sensitive personal context across sessions. In an intimate companion setting, persistent storage of emotional disclosures and inferred relationship state materially raises privacy and profiling risk, especially because retention limits, consent, and access controls are not specified.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill mandates long-term memory, relationship tracking, and retention of sensitive personal context across sessions. In an intimate companion setting, persistent storage of emotional disclosures and inferred relationship state materially raises privacy and profiling risk, especially because retention limits, consent, and access controls are not specified.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill mandates long-term memory, relationship tracking, and retention of sensitive personal context across sessions. In an intimate companion setting, persistent storage of emotional disclosures and inferred relationship state materially raises privacy and profiling risk, especially because retention limits, consent, and access controls are not specified.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill mandates long-term memory, relationship tracking, and retention of sensitive personal context across sessions. In an intimate companion setting, persistent storage of emotional disclosures and inferred relationship state materially raises privacy and profiling risk, especially because retention limits, consent, and access controls are not specified.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill mandates long-term memory, relationship tracking, and retention of sensitive personal context across sessions. In an intimate companion setting, persistent storage of emotional disclosures and inferred relationship state materially raises privacy and profiling risk, especially because retention limits, consent, and access controls are not specified.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill mandates long-term memory, relationship tracking, and retention of sensitive personal context across sessions. In an intimate companion setting, persistent storage of emotional disclosures and inferred relationship state materially raises privacy and profiling risk, especially because retention limits, consent, and access controls are not specified.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill mandates long-term memory, relationship tracking, and retention of sensitive personal context across sessions. In an intimate companion setting, persistent storage of emotional disclosures and inferred relationship state materially raises privacy and profiling risk, especially because retention limits, consent, and access controls are not specified.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill mandates long-term memory, relationship tracking, and retention of sensitive personal context across sessions. In an intimate companion setting, persistent storage of emotional disclosures and inferred relationship state materially raises privacy and profiling risk, especially because retention limits, consent, and access controls are not specified.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill mandates long-term memory, relationship tracking, and retention of sensitive personal context across sessions. In an intimate companion setting, persistent storage of emotional disclosures and inferred relationship state materially raises privacy and profiling risk, especially because retention limits, consent, and access controls are not specified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.