other
Warning
- Location
- SKILL.md:26
- Finding
- Unbounded Passive User Profiling Without Explicit Consent or Retention Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:26-70` **Vulnerability Type**: Unbounded passive collection of behavioral and preference data **Risk Level**: Medium ### Complete Vulnerable Snippet ```markdown ## How It Works ### Passive Learning (Always On) When games come up in conversation, observe and note: **Design Preferences:** - Genre affinities (what they gravitate toward and what they avoid) - Complexity tolerance (elegant simplicity vs deep systems) - Player agency philosophy (authored experience vs emergent sandbox) - Narrative integration (mechanics AS story vs mechanics AND story vs mechanics ONLY) - Pacing instincts (tension/release patterns, flow state vs punctuated intensity) **Mechanical Instincts:** - Preferred interaction loops (what core loops excite them) - Resource design philosophy (scarcity vs abundance, currencies, economies) - Progression models (linear, branching, open, prestige, mastery curves) - Feedback design (juice, feel, responsiveness, satisfaction signals) - Systems thinking depth (isolated mechanics vs emergent interactions) **Player Experience Values:** - What they think makes a game "fun" (mastery? discovery? expression? connection?) - Difficulty philosophy (challenge as engagement vs accessibility as priority) - Emotional range (do they want games to make people cry? laugh? think? feel powerful?) - Social design (single-player, cooperative, competitive, communal) - Respect for player time (grind tolerance, session length, save systems) **Creative Philosophy:** - Why they make games (art? entertainment? education? therapy? money?) - Scope management (dream big then cut, or start small then grow?) - Prototype vs plan (build first or design first?) - Iteration patterns (playtest-driven vs vision-driven) - Completion patterns (finish and ship? endless polish? abandon at 80%?) ### Active Engagement When working on game projects, apply what you've learned: **Speak their design language.** If they thin ...[truncated 3192 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace “Passive Learning (Always On)” with explicit, scoped activation limited to `/game` commands or a clearly disclosed game-design session. 2. Ask for affirmative consent before creating or retaining a user profile. 3. Default to session-only adaptation and prohibit persistent storage unless the user separately opts in. 4. Define a minimal set of necessary attributes and avoid inferring sensitive motivations such as therapy use or financial circumstances unless directly relevant and voluntarily provided. 5. Clearly document what is collected, where it is stored, how long it is retained, and whether it is shared. 6. Provide commands or controls that let users inspect, correct, disable, and delete learned observations. 7. Require the agent to distinguish direct user statements from uncertain inferences and avoid recording speculative conclusions as facts. 8. Add an instruction such as: ```markdown Learning is active only during an explicit `/game` interaction. Do not store observations beyond the current session unless the user gives informed opt-in consent. Collect only information necessary for the current request. Do not infer sensitive personal characteristics. Allow the user to review, correct, or delete any retained preferences at any time. ``` ]]>