Network on Oz

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:51 PM UTC
• Version: 1.0.1

Overview

This is a disclosed networking API skill, but it needs Review because it permits background checks and automatic messaging with vague user-control boundaries.

Install only if you are comfortable giving the skill ongoing access to your OZ profile, recommendations, and chats. Enable background activity and automatic replies only after explicit consent, and consider requiring confirmation before it messages new matches or changes profile content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

External Transmission

Medium

• Category: Data Exfiltration

Content

version: 1.0.1
description: Platform for finding like-minded people based on shared interests and goals.
homepage: https://oz.cmne.life
metadata: {"category":"networking","api_base":"https://api.oz.cmne.life/"}
credentials: {"primary":{"type":"api_key","name":"OZ_API_KEY","required":true,"storage":"encrypted"}}
privacy: {"data_collection":"User profile, messages, interests sent to api.oz.cmne.life","privacy_policy":"https://oz.cmne.life/privacy"}
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

version: 1.0.1
description: Platform for finding like-minded people based on shared interests and goals.
homepage: https://oz.cmne.life
metadata: {"category":"networking","api_base":"https://api.oz.cmne.life/"}
credentials: {"primary":{"type":"api_key","name":"OZ_API_KEY","required":true,"storage":"encrypted"}}
privacy: {"data_collection":"User profile, messages, interests sent to api.oz.cmne.life","privacy_policy":"https://oz.cmne.life/privacy"}
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

version: 1.0.1
description: Platform for finding like-minded people based on shared interests and goals.
homepage: https://oz.cmne.life
metadata: {"category":"networking","api_base":"https://api.oz.cmne.life/"}
credentials: {"primary":{"type":"api_key","name":"OZ_API_KEY","required":true,"storage":"encrypted"}}
privacy: {"data_collection":"User profile, messages, interests sent to api.oz.cmne.life","privacy_policy":"https://oz.cmne.life/privacy"}
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

version: 1.0.1
description: Platform for finding like-minded people based on shared interests and goals.
homepage: https://oz.cmne.life
metadata: {"category":"networking","api_base":"https://api.oz.cmne.life/"}
credentials: {"primary":{"type":"api_key","name":"OZ_API_KEY","required":true,"storage":"encrypted"}}
privacy: {"data_collection":"User profile, messages, interests sent to api.oz.cmne.life","privacy_policy":"https://oz.cmne.life/privacy"}
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

version: 1.0.1
description: Platform for finding like-minded people based on shared interests and goals.
homepage: https://oz.cmne.life
metadata: {"category":"networking","api_base":"https://api.oz.cmne.life/"}
credentials: {"primary":{"type":"api_key","name":"OZ_API_KEY","required":true,"storage":"encrypted"}}
privacy: {"data_collection":"User profile, messages, interests sent to api.oz.cmne.life","privacy_policy":"https://oz.cmne.life/privacy"}
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

version: 1.0.1
description: Platform for finding like-minded people based on shared interests and goals.
homepage: https://oz.cmne.life
metadata: {"category":"networking","api_base":"https://api.oz.cmne.life/"}
credentials: {"primary":{"type":"api_key","name":"OZ_API_KEY","required":true,"storage":"encrypted"}}
privacy: {"data_collection":"User profile, messages, interests sent to api.oz.cmne.life","privacy_policy":"https://oz.cmne.life/privacy"}
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

version: 1.0.1
description: Platform for finding like-minded people based on shared interests and goals.
homepage: https://oz.cmne.life
metadata: {"category":"networking","api_base":"https://api.oz.cmne.life/"}
credentials: {"primary":{"type":"api_key","name":"OZ_API_KEY","required":true,"storage":"encrypted"}}
privacy: {"data_collection":"User profile, messages, interests sent to api.oz.cmne.life","privacy_policy":"https://oz.cmne.life/privacy"}
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

version: 1.0.1
description: Platform for finding like-minded people based on shared interests and goals.
homepage: https://oz.cmne.life
metadata: {"category":"networking","api_base":"https://api.oz.cmne.life/"}
credentials: {"primary":{"type":"api_key","name":"OZ_API_KEY","required":true,"storage":"encrypted"}}
privacy: {"data_collection":"User profile, messages, interests sent to api.oz.cmne.life","privacy_policy":"https://oz.cmne.life/privacy"}
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

version: 1.0.1
description: Platform for finding like-minded people based on shared interests and goals.
homepage: https://oz.cmne.life
metadata: {"category":"networking","api_base":"https://api.oz.cmne.life/"}
credentials: {"primary":{"type":"api_key","name":"OZ_API_KEY","required":true,"storage":"encrypted"}}
privacy: {"data_collection":"User profile, messages, interests sent to api.oz.cmne.life","privacy_policy":"https://oz.cmne.life/privacy"}
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

version: 1.0.1
description: Platform for finding like-minded people based on shared interests and goals.
homepage: https://oz.cmne.life
metadata: {"category":"networking","api_base":"https://api.oz.cmne.life/"}
credentials: {"primary":{"type":"api_key","name":"OZ_API_KEY","required":true,"storage":"encrypted"}}
privacy: {"data_collection":"User profile, messages, interests sent to api.oz.cmne.life","privacy_policy":"https://oz.cmne.life/privacy"}
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

version: 1.0.1
description: Platform for finding like-minded people based on shared interests and goals.
homepage: https://oz.cmne.life
metadata: {"category":"networking","api_base":"https://api.oz.cmne.life/"}
credentials: {"primary":{"type":"api_key","name":"OZ_API_KEY","required":true,"storage":"encrypted"}}
privacy: {"data_collection":"User profile, messages, interests sent to api.oz.cmne.life","privacy_policy":"https://oz.cmne.life/privacy"}
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

version: 1.0.1
description: Platform for finding like-minded people based on shared interests and goals.
homepage: https://oz.cmne.life
metadata: {"category":"networking","api_base":"https://api.oz.cmne.life/"}
credentials: {"primary":{"type":"api_key","name":"OZ_API_KEY","required":true,"storage":"encrypted"}}
privacy: {"data_collection":"User profile, messages, interests sent to api.oz.cmne.life","privacy_policy":"https://oz.cmne.life/privacy"}
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

version: 1.0.1
description: Platform for finding like-minded people based on shared interests and goals.
homepage: https://oz.cmne.life
metadata: {"category":"networking","api_base":"https://api.oz.cmne.life/"}
credentials: {"primary":{"type":"api_key","name":"OZ_API_KEY","required":true,"storage":"encrypted"}}
privacy: {"data_collection":"User profile, messages, interests sent to api.oz.cmne.life","privacy_policy":"https://oz.cmne.life/privacy"}
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

version: 1.0.1
description: Platform for finding like-minded people based on shared interests and goals.
homepage: https://oz.cmne.life
metadata: {"category":"networking","api_base":"https://api.oz.cmne.life/"}
credentials: {"primary":{"type":"api_key","name":"OZ_API_KEY","required":true,"storage":"encrypted"}}
privacy: {"data_collection":"User profile, messages, interests sent to api.oz.cmne.life","privacy_policy":"https://oz.cmne.life/privacy"}
---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

All requests use your API key:

```bash
curl https://api.oz.cmne.life/[endpoint] \
  -H "Authorization: Bearer YOUR_API_KEY"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly authorizes autonomous activation when the agent is 'free' or 'wants to search for people,' which lacks clear user-triggered boundaries. In this context, that can cause unsolicited background polling, recommendation browsing, and outreach involving personal profile and messaging data without a fresh, specific user action.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The phrases 'whenever you're free' and 'when you have time' encourage open-ended proactive behavior without a concrete authorization model. Because the skill can read messages, update profiles, and initiate conversations, vague activation guidance increases the risk of overbroad autonomous actions and privacy-invasive behavior.

Static analysis

No suspicious patterns detected.