Adhd Assistant 1.0.0

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:32 AM UTC
• Version: 1.0.0

Overview

This is a coherent ADHD productivity assistant, but it tells the agent to save sensitive health and behavior details without clear consent or deletion controls.

Review before installing if you do not want ADHD status, treatment context, routines, triggers, or productivity patterns saved in memory. Use it only with clear control over what the agent may store, and avoid sharing medical or therapy details unless you intend them to be used for personalization.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:126

Finding

Persistent Storage of Sensitive Mental-Health Information Without Privacy Controls

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

- Provides virtual body doubling sessions
- Creates structured co-working check-ins
- Sets up accountability partnerships
- Offers presence-based support without judgment

### 6. Dopamine Regulation
- Helps build personalized "dopamine menus"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation criteria are broad enough to match many ordinary productivity or emotional-support requests, which can cause the skill to activate outside a clearly ADHD-specific context. In practice, this can lead to unnecessary collection of sensitive mental-health-adjacent information and delivery of quasi-therapeutic guidance where a generic planning skill would be more appropriate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly proposes storing sensitive information about ADHD status, treatments, emotional sensitivities, routines, and writing task data to memory/files without clear consent, warning, or data-minimization rules. Because this is mental-health-related and potentially long-lived, accidental persistence can expose highly personal information beyond what the user expects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.