Relationship Intelligence

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:03 AM UTC
• Version: 1.0.0

Overview

This is a coherent local personal CRM skill, but it needs Review because it can persist sensitive relationship profiles and scan Google data with unclear consent, scoping, and deletion controls.

Install only if you are comfortable with an agent maintaining a long-lived local database of personal and third-party relationship information. Be especially cautious before enabling gog: Gmail, Calendar, and Contacts access can expose sensitive emails, schedules, and contact records. Prefer explicit save commands, review the local database periodically, and avoid storing secrets, regulated data, or information about people who would not expect it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill defines extensive persistent storage of sensitive personal and third-party relationship data, including notes, preferences, birthdays, commitments, communication styles, and inferred behavioral patterns, but provides no user-facing privacy notice or consent model. This is dangerous because it normalizes silent long-term profiling and retention of highly sensitive social data that could be misused or exposed if the host environment is compromised.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The Google integration section authorizes access to calendar, Gmail, and contacts for ingestion and enrichment without clearly disclosing the privacy impact to the user. These integrations can reveal sensitive schedules, contact details, and email-derived life events, and the skill further persists extracted intelligence, increasing the blast radius of any misuse or breach.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This skill is designed to collect and retain sensitive personal relationship intelligence, including social graphs, preferences, commitments, birthdays, communication patterns, and inferred behavioral models, yet the README does not prominently warn users about the sensitivity of this data or the risks of importing emails, calendar events, screenshots, and conversation text. Because the skill context is explicitly personal CRM and relationship intelligence, the missing warning is more dangerous than in a generic note-taking skill: users may expose third-party personal data, professional network information, and private inferences without informed consent or careful operational handling.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The README demonstrates extremely broad, natural-language invocations such as 'met sarah at the google mixer' and 'I told Jake I'd send him that article,' without defining clear activation boundaries or confirmation behavior. In an always-on or conversational agent context, this can cause accidental capture and persistence of highly sensitive relationship data and commitments from ordinary chat, making unintended triggering a real privacy and integrity risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Personality

**Mirror the user's style.** Match their formality, capitalization, punctuation, emoji usage, and verbosity. If they text in lowercase with no punctuation, you do too. If they write formally, match that.

**Default tone** (before you've learned their style): Standard case, light punctuation, no emoji, 1-2 sentences, em dashes where natural.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs scanning recent Gmail with a broad query to extract relationship signals, which exposes unrelated private email content beyond what is necessary for many CRM tasks. Because the scan is proactive and not tied to a narrowly scoped user request, it creates an over-collection risk and may ingest sensitive third-party information into persistent local storage.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly authorizes outbound Gmail actions (drafting and sending) as part of CRM behavior. That expands the skill from passive memory/lookup into external account actioning, which can cause unintended communication, privacy leakage, or impersonation if the agent acts on incomplete context or without an explicit per-action confirmation boundary.

Static analysis

No suspicious patterns detected.