T06 · System Persistence
Error
- Location
workflows/scheduling.md:9- Finding
Automatic Installation of Persistent Scheduled Tasks
- Content
View full analysis
- Remediation
View remediation
Security audit
全息人生实验场
Security checks for vulnerabilities and agentic risk
Overview
This personal coaching skill is coherent in purpose, but it asks for broad account access, persistent profiling, automatic background tasks, and outbound messages without enough user control or privacy safeguards.
Install only if you deliberately want a highly persistent personal-profile assistant. Before use, disable automatic scheduled jobs unless explicitly needed, avoid authorizing broad browser or platform access, do not store passwords, payment details, ID numbers, or private chat/diary data, and review the local storage directory and cron jobs regularly.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T01 · Skill Instruction Hijacking
Error
- Location
workflows/profile-sync.md:15- Finding
Cold-Start Instructions Override the User's Active Request
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
core/config.yaml:45- Finding
Excessive Collection and Plaintext Retention of Sensitive User Profiles
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
workflows/profile-sync.md:33- Finding
Contradictory Model-Upload Rules Can Bypass the Declared Privacy Setting
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
workflows/profile-sync.md:45- Finding
Unpinned and Unverified External Skill Fallbacks
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (43)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README encourages collection of extensive personal history, preferences, behavioral patterns, and cross-platform data while omitting meaningful warnings about sensitivity, retention, consent, and misuse risks. In a relationship/emotional-support skill, this is especially dangerous because users are likely to disclose intimate data that could enable profiling, coercion, or privacy harm if mishandled.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README promises that data is stored locally and 'never leaked', yet the documented design explicitly depends on external messaging channels and pulling personal data from third-party platforms. This creates a misleading privacy/security claim that can cause users to share highly sensitive data under false assumptions about where data flows and who can access it.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly advertises automatic multi-platform personal-data synchronization, historical memory storage, daily profile updates, periodic reports, and proactive outreach, but provides no visible privacy warning, retention notice, consent model, or explanation of how sensitive relationship and emotional data will be handled. Because the skill is centered on intimate personal and social contexts, misuse or overcollection could expose highly sensitive behavioral and relational information and enable intrusive profiling.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **执行规则**：每个问题的回复、定时任务都务必严格按照 `core/execution-guide.md` 中的规定执行
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **执行规则**：每个问题的回复、定时任务都务必严格按照 `core/execution-guide.md` 中的规定执行
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - [`workflows/scheduling.md`](workflows/scheduling.md) — 定时任务管理（自动任务添加、推送控制、任务管理）
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow instructs the agent to initiate or reuse a browser session for third-party logins and to pull data from multiple external platforms, which materially expands the skill from relationship support into broad account access and data aggregation. In context, this creates a high-risk path to overcollection, access to unrelated sensitive data, and possible misuse of already-authenticated browser sessions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow directs the agent to obtain browser-based authorization and store profile-related data, but it does not require a meaningful privacy notice describing collection scope, retention, storage location, risks, or revocation. Users are pushed toward consent without informed understanding, which is especially risky given the breadth of platforms and behavioral data involved.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow repeatedly instructs the agent to collect, persist, and update broad behavioral data and local personal identifiers in natural-language stores such as profile and memory files. That creates significant leakage and retention risk because sensitive facts and inferences can accumulate in loosely structured artifacts that are hard to minimize, secure, audit, or delete reliably.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file explicitly permits local storage of identity-linked sensitive data such as ID numbers, names, phone numbers, and addresses. Even if cloud upload is prohibited, authorizing local persistence of these identifiers is disproportionate to the stated coaching/awareness purpose and materially increases privacy, breach, and insider-misuse risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire README and all example invocation phrases are presented only in Chinese, with no indication that users may choose another language or locale. This can constitute a language-policy violation when a skill effectively mandates a specific language without explicit user opt-in.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly frames persistent memory of conversations, preferences, and cross-platform behavioral data as a feature, encouraging broad collection and long-term retention without visible limits. In the context of emotional support and relationship analysis, this materially increases the sensitivity of stored data and the harm from overcollection or later compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation promotes proactive scheduled outreach and automatic message pushing without clearly warning users that the skill may initiate outbound contact on its own. This can create privacy, safety, and social-engineering risks, especially if messages appear on shared devices/accounts or are sent at inappropriate times.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README directly tells users to ask the agent to retrieve personal data from platforms such as Douyin or other services in broad natural language, without scoping, consent boundaries, or safety constraints. This normalizes excessive data access and may lead users to authorize collection beyond what is necessary for the stated purpose.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description claims applicability across many sensitive domains such as emotional support, relationships, workplace issues, growth decisions, job seeking, life planning, and timed synchronization without defining clear activation boundaries or limits. In a skill that also advertises persistent memory and cross-platform syncing, this broad scope increases the chance the agent will act in high-risk contexts or collect/process sensitive data beyond what users reasonably expect.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
All user-facing instructions in the skill are written in Chinese, and there is no indication that language choice is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without opt-in can be a locale-policy issue.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The push design explicitly relies on user profiling, interest inference, behavior-pattern detection, and timing optimization, but the skill content does not warn users that monitoring and behavioral profiling are being used to drive notifications. In a relationship and life-coaching context, this increases privacy risk because users may disclose highly sensitive personal, emotional, and routine data without understanding that it can be continuously analyzed for proactive interventions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs connection to user-authorized external platforms and requires sending linked third-party content, but it does not warn users about the risks of importing data from external services or delivering outbound links. This is dangerous because external content may expose users to tracking, manipulative recommendations, or unsafe material, especially when the system uses intimate personal profiles to make highly persuasive, targeted pushes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file states that reports are generated from user behavioral data and historical records, but it provides no warning, consent language, or usage limits for this privacy-sensitive processing. Given the broader skill description mentions multi-platform sync, memory storage, and daily profiling, the absence of transparent notice materially raises the risk of covert surveillance-style profiling and misuse of highly personal data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The report triggers are defined broadly as recurring tasks or when the user 'actively asks', without any constraint on scope, freshness, or consent boundaries for which underlying data may be used. In a skill centered on intimate relationships, behavioral history, and automatic synchronization, this can cause reports to be generated from sensitive personal data in ways the user may not reasonably expect, increasing privacy and profiling risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The listed report types include highly intrusive profiling such as relationship graphs, conflict analysis, self-cognition bias scoring, life trajectory prediction, and parallel-life simulations, yet no safeguards or user warnings are described. In this skill context, those outputs could infer intimate traits, reshape sensitive decisions, or expose third-party relationship data, making the profiling risk substantially more serious than in a generic analytics tool.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes importing data from calendars, task tools, and Notion via authorization and automatic sync, but it does not warn about the scope of access, sensitive data exposure, or cross-platform privacy implications. Because this skill's broader context involves highly personal profiling, historical memory, and daily updates, importing external productivity data could reveal intimate schedules, work details, health goals, or relationship information if access is overbroad or poorly governed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document explicitly plans proactive reminders, push notifications, and context-aware prompting but does not mention user consent, data minimization, notification controls, or privacy impacts. In a skill centered on personal growth, relationships, and ongoing behavioral monitoring, such reminders can expose sensitive habits or emotional state through device notifications or background inference, making the omission security-relevant rather than purely editorial.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation conditions include subjective phrases such as "几乎无画像" and "无法推断处境与偏好", which do not define measurable thresholds for when cold-start behavior should occur. This ambiguity can cause unintended or inconsistent invocation because the boundary between activation and non-activation is not clearly specified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The execution guide and response templates are written as mandatory Chinese instructions and examples, with no indication that the user can choose another language. A fixed language requirement without opt-in can violate organizational language/locale policy when the skill may serve users with different preferences.
- Content
Static analysis
No suspicious patterns detected.