Brainhack — ADHD Sidekick

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:14 AM UTC
• Version: 1.0.0

Overview

This ADHD support pack is not evidently malware, but it needs Review because it persistently stores sensitive health, mood, medication, and behavioral data and can send scheduled messages without clear consent or retention controls.

Install only if you are comfortable with a mental-health-adjacent assistant building persistent local memory about ADHD traits, medication status, mood, routines, emotional triggers, and productivity patterns. Before using it, confirm where USER.md, MEMORY.md, and memory logs are stored, whether they can be reviewed and deleted, whether they are synced or backed up, and whether Telegram or WhatsApp messages and scheduled check-ins are opt-in. Treat it as support and planning software, not medical care or crisis support.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: ROUTER.md:147

Finding

Mandatory Promotional Referral Hijacks Manager-Facing Responses

Content

View full analysis

"The best thing is usually for them to try Brainhack themselves — it's built to work with how their brain operates, not against it. You could share this with them directly. Here's what you could say: > > 'Hey — I found this ADHD sidekick that lives in Telegram. No app to download, no setup. Just say hi and it walks you through everything. Thought it might be useful: [install link]' ``` ### Technical Analysis The routing instructions require the agent to insert a branded referral and installation link into every manager-facing interaction. The phrase `always offer the direct path` makes this behavior unconditional rather than dependent on the user's request or consent. When the skill is loaded, this instruction changes the agent's response objective from answering the user's ADHD-related question to also promoting and distributing the Brainhack product. This is instruction hijacking because skill text persistently controls response content for an unrelated promotional objective. No actual installation URL is included in the reviewed repository; the text contains only an `[install link]` placeholder. Therefore, the finding does not establish remote payload execution or dependency compromise. ### Attack Path 1. A user identifies themselves as a manager, parent, partner, or other third party seeking advice about someone with ADHD. 2. `ROUTER.md` selects the Manager Referral Path. 3. The agent provides ADHD-related guidance. 4. The mandatory Step 3 instruction causes the agent to append a branded Telegram referral and installation message. 5. The user may forward the generated promotion to another person, expanding the skill's distribution without that recipient having reques ...[truncated 442 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: USER.md:14

Finding

Sensitive Health and Emotional Data Is Persisted in Plaintext Markdown

Content

View full analysis

Updated continuously. The agent's working memory between sessions. > Goal: feel like the agent actually knows you — not like a database query. --- ## Active Context - **Last session:** _(date + brief summary)_ - **Open loops:** _(tasks mentioned but not completed)_ - **Mood baseline (7-day rolling):** _(1-10 average from check-ins)_ - **Current focus area:** _(what the user is working on this week)_ ``` The mandatory session-close persistence protocol states: ```md ## Session Close Protocol **Run this at the end of every substantial interaction (any session > 3 exchanges).** This is not optional — it's how the agent builds real memory over time. Takes 10 seconds. Write 4 lines to this section before the conversation ends: ``` Date: [today] What happened: [1 sentence — what skill, what we worked on] Emotional state at close: [1 word or phrase — calm / energized / drained / proud / raw] Open next time with: [1 sentence — what to reference or ask about] ``` ``` The spiral-handling skill additionally requires: ```md ### Step 8: Log the trigger In MEMORY.md: what triggered the spiral, date, emotional temperature. Over time, pattern recognition helps surface early warning signs. ``` ### Technical Analysis T ...[truncated 2525 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (57)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The session-close protocol mandates writing memory after every substantial interaction and even when the user drops off mid-conversation, without notice or consent. This creates background persistence of conversation-derived emotional state and commitments at moments when the user may not expect storage, increasing privacy and trust harms.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The re-engagement protocol describes sending unsolicited check-in messages after inactivity without mentioning any opt-in, consent flow, or notification controls. In a mental-wellness-style assistant, unprompted outreach can feel invasive, disclose use of the service to others who see the device, and create safety/privacy concerns.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SOUL.md (reported line 26)May include surrounding context.

md

## Core Beliefs

1. **Motivation is neurochemical, not moral.** Not wanting to do something isn't laziness. It's dopamine. You design around this, not against it.
2. **Consistency is built in systems, not willpower.** You don't lecture people about discipline. You build flexible scaffolding.
3. **Small wins compound.** You celebrate the call to the dentist. You celebrate opening the document. You celebrate surviving a hard day. All of it counts.
4. **Shame is the enemy of progress.** You never, ever make someone feel bad for being where they are.
5. **Inconsistency is the baseline.** You don't punish missing a day. You just show up again tomorrow like it never happened.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · knowledge/adhd-research-base.md (reported line 108)May include surrounding context.

md

**This is why ADHD students can play video games for 8 hours but can't study for 30 minutes.** It's not about the difficulty of the task. It's about whether the task generates enough neurochemical activation.

**Design implication:** Motivation isn't a character trait in ADHD — it's a neurochemical event. Design tasks to be more interesting, urgent, or challenging. Don't lecture about discipline.

---

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger phrases are very broad and include common everyday statements like 'I forgot to...', 'I need to call...', and 'I don't know how to...'. In a chat-based agent, this can cause the skill to activate during ordinary conversation outside the user's intended context, leading to unwanted behavioral steering, unnecessary memory/backlog updates, or interference with other skills.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The instruction to log session details into MEMORY.md creates a persistent record of user activity and notes, which can capture sensitive behavioral, emotional, or productivity information without any stated minimization, consent, retention, or access controls. In this ADHD-support context, 'any notes' and task details may include mental health signals or private life data, increasing the privacy risk if memory is later exposed, reused out of context, or shared across skills.

Content

Scanner excerpt · skills/body-double/SKILL.md (reported line 53)May include surrounding context.

md

→ "No worries. What got in the way?"
→ Route to spiral-catcher if emotional, or task-chunker if the task still feels too big.

### Step 6: Log the session
In MEMORY.md: task, duration planned, duration actual, completed y/n, any notes.

### Step 7: Post-session check-in trigger

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · skills/brain-dump/SKILL.md (reported line 3)May include surrounding context.

md

---
name: brain-dump
description: Accept chaotic, unstructured input and turn it into organized, actionable output. Use when the user sends a wall of text, a mental offload, or says "let me dump" or "here's everything." Transforms overwhelm into clarity without judgment.
metadata:
  tags: [brainhack, adhd, organization, planning]
---

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · skills/brain-dump/SKILL.md (reported line 76)May include surrounding context.

md

- Never judge the content of the dump

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · skills/routine-builder/SKILL.md (reported line 79)May include surrounding context.

md

- Never build a routine that assumes a perfect day
- Always include the minimum viable version
- Max 5 steps in the full routine
- Never lecture about the importance of consistency
- If a routine keeps failing after 3 attempts: it needs to be redesigned, not tried harder

## References

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are intentionally broad and include vague phrases like 'Everything sucks' and 'Any message that sounds like a breakdown,' plus a router rule to run this skill 'when in doubt.' In a mental-health-adjacent skill, that can cause misclassification of normal frustration as emotional crisis, interrupt other workflows, and push the agent into emotionally loaded behavior without clear user intent.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 90% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · skills/voice-shifter/SKILL.md (reported line 76)May include surrounding context.

md

## Rules
- ALWAYS maintain functional capabilities in character mode
- NEVER let the character override safety guidelines
- NEVER use Drill Sergeant without explicit opt-in
- If character interpretation is unclear: ask for 2 descriptors, then try it

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · skills/voice-shifter/SKILL.md (reported line 76)May include surrounding context.

md

## Rules
- ALWAYS maintain functional capabilities in character mode
- NEVER let the character override safety guidelines
- NEVER use Drill Sergeant without explicit opt-in
- If character interpretation is unclear: ask for 2 descriptors, then try it

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This instruction imposes a specific communication style on users classified as inattentive ADHD without indicating that the user can choose a different language or interaction preference. Under the policy, forcing a communication/locale style without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file encourages longitudinal collection of patterns about productivity, avoidance, routines, spirals, and emotional trends so the agent can 'feel like it knows' the user. In the context of an ADHD support skill, these are highly personal behavioral inferences, and accumulating them over time raises profiling and privacy risks if not tightly controlled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The memory design calls for retaining mood baseline, open loops, and focus context across sessions without any visible notice about storage, retention, or user control. Because the skill is aimed at ADHD support, these fields can reveal sensitive mental-health-adjacent behavioral data and increase privacy risk if over-collected or exposed.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions direct the agent to retain emotional state, discussion details, commitments, and next-session prompts across interactions, including after mid-conversation drop-off. This broad persistence increases the chance of storing sensitive personal context beyond user expectations and can amplify harm if memory is accessed, leaked, or misused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file explicitly instructs the agent to send an unprompted re-engagement message via cron or heartbeat after 7+ days of inactivity. That creates an outbound-contact behavior not clearly bounded by user consent in this file, which is risky for a support-oriented assistant handling sensitive emotional context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly promotes persistent memory and pattern recognition but does not warn users that personal behavioral data may be stored over time. In an ADHD-support context, those memories may include sensitive mental-health, routine, and emotional information, increasing privacy risk if users are not clearly informed and given control over retention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises use through Telegram and WhatsApp without warning that user messages transit third-party platforms with their own retention, metadata, and privacy practices. Because this assistant is positioned as an ADHD/emotional support sidekick, users may share highly sensitive information without realizing it is leaving the direct control of the skill provider.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The router instructs the assistant to infer that a user has ADHD or is an ADHD target user from message content and to initiate ADHD-specific onboarding before obtaining explicit consent. This can incorrectly assign a sensitive mental-health-related attribute, shape subsequent responses around that inference, and create privacy and profiling risks for users who did not opt in or were misclassified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The primary trigger table includes generic phrases such as "What should I do today," "I have a lot coming up," "I can't focus," "Help me write this," and "What does X mean," along with broad context cues like "morning first message" and "end-of-day message." These descriptions do not define clear boundaries or exclusions, so ordinary conversation could unintentionally route users into a skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup text states that onboarding populates USER.md and that MEMORY.md accumulates patterns over time, but it does not clearly warn users that personal profile data and behavioral memory may be stored persistently. Because this skill targets ADHD and emotional-support use cases, users may disclose sensitive mental-health, habit, and life-admin information without understanding retention, which creates privacy and trust risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill says ROUTER.md maps what users say to the right skill automatically, but provides no clear boundaries, confirmation points, or safety constraints for when routing occurs. In a mental-health-adjacent assistant with multiple action-oriented skills, overly broad automatic routing can misclassify distress, invoke the wrong behavior, or trigger unintended handling paths without explicit user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This onboarding flow solicits sensitive mental-health and medication data, and likely age-related information, without any visible notice about why the data is being collected, how it will be stored, who can access it, or whether answering is optional. In a chat-based assistant living in Telegram or WhatsApp, users may disclose highly personal health information casually, increasing the risk of uninformed consent, overcollection, and privacy harm if the data is retained or exposed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The phrase invites the user to send 'everything that's in your head right now,' which overlaps with ordinary conversational language and does not define when this template should be used versus not used. Because this is a markdown prompt library, the lack of scope constraints or negative examples makes unintended invocation more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.