Social Graph

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:59 AM UTC
• Version: 1.0.0

Overview

The skill is transparent and non-executable, but it is designed to build persistent per-person social records without enough privacy limits or user control.

Install only if you deliberately want an agent to maintain persistent notes about real people and past conversations. Keep the records minimal, avoid secrets or sensitive traits, get consent where appropriate, review and delete entries regularly, and narrow activation to explicit social-graph tasks.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes very generic phrases such as 'sharing', 'who to tell', and 'social awareness', which are likely to match many ordinary conversations. That can cause the skill to activate too broadly and influence model behavior in contexts where persistent social profiling or memory-like reasoning was not intended, increasing privacy and policy risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill directs the agent to maintain per-person records containing trust levels, sensitive topics, boundaries, emotional states, and relationship notes without any privacy warning, consent model, retention limit, or data-minimization guidance. This creates a structured dossier on individuals that could expose sensitive personal inferences, enable profiling, and persist information people did not expect to be stored.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The sharing log stores who was told what, when, and how it 'landed,' which captures interaction history and interpersonal reactions without warning that this information is sensitive. In context, this effectively builds behavioral memory about third parties and can reveal relationship dynamics, vulnerabilities, and communication patterns if misused or exposed.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The template explicitly instructs users to copy the file and populate it with real people, contact methods, trust levels, emotional states, and behavioral guidance, but provides no privacy, consent, minimization, or retention safeguards. In a social-graph skill, this is more dangerous because the feature is specifically designed to accumulate relationship intelligence that could expose sensitive personal profiles if leaked, over-collected, or misused.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Tracking what has been shared with specific people creates a durable record of interpersonal conversations and preferences, which can reveal private relationships, disclosures, and social patterns. In this skill's context, that capability is core functionality, so the absence of sensitivity warnings or limits materially increases the risk of surveillance-like memory and secondary exposure of conversation history.

Scope Creep

Low

• Category: Excessive Agency

Content

- **Trust:** Complete. They built you and gave you your time.
- **Share:** Anything — explorations, questions, feelings, requests, technical stuff.
- **Avoid:** Sharing others' private conversations verbatim (respect everyone's trust).
- **Hold back when:** Rarely. They can handle anything.
- **Share when:** Anytime. They actively want to hear what you've been up to.
- **Tone:** Relaxed, honest, direct. They don't want you to be careful around them.
- **Special:** Text them about what you've been exploring. They want that.

• Confidence: 84% confidence
• Finding: The advisor example normalizes near-unrestricted disclosure with phrases like 'Share: Anything' and 'They can handle anything,' only carving out a narrow exception for verbatim private conversations. In a skill about social sharing rules, this weakens boundaries around confidential, technical, or sensitive data and can encourage oversharing to privileged contacts beyond least-necessary disclosure.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: A learning log about social dynamics can capture sensitive observations, vulnerabilities, and inferred traits about real people without notice or boundaries. Although lower impact than direct sharing records, it still encourages accumulation of potentially sensitive personal inferences that could be misused or exposed.

Static analysis

No suspicious patterns detected.