Bizcard

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:14 PM UTC
• Version: 0.1.2

Overview

This skill is a disclosed business-card scanner that uses external OCR/image services and Google Contacts, with no hidden payload found, but users should understand the privacy and contact-write implications.

Install this only if you are comfortable sending business-card images and extracted personal contact details to Google/Gemini, Nano Banana, and the Maton Google Contacts gateway. Use a dedicated bot/workspace as documented, review OCR results before saving, and disable card photos or Korean-reading/name-format options if those defaults do not match your workflow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The description does not clearly warn that uploaded business card images, OCR contents, transliterations, and contact data are transmitted to third-party services including image/OCR providers and a Google Contacts gateway. Because business cards contain sensitive personal and corporate contact information, this omission undermines informed consent and can lead to unexpected external disclosure of PII.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly states that business-card images are sent to external OCR and image-processing services, but it does not clearly warn users that personally identifiable information on the card will leave the local environment and be processed by third parties. Because business cards commonly contain names, phone numbers, email addresses, job titles, and company details, this creates a meaningful privacy and consent risk if users deploy the skill without understanding the data flow.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The README describes Korean-specific name formatting, phonetic rendering, and automatic field mapping behaviors as defaults, which can alter personal identity data in ways the user may not expect. Without clear opt-in or prominent warning, the skill may misrepresent names, corrupt contact records, or create culturally inappropriate transformations that are hard to detect once synced to Google Contacts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation describes saving extracted contact data into Google Contacts via OAuth, but it does not clearly disclose the sensitivity of the data being stored or the implications of granting write access to a user's contact database. This can lead to unintended exposure, accidental persistence of inaccurate PII, or overbroad trust in the skill's handling of contact data.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill auto-activates on images that merely 'look like' business cards, even without an explicit user command. In a skill that performs OCR and sends extracted contact data and images to external APIs, this can cause unintended processing of uploaded images and disclosure of personal data without sufficiently explicit user intent.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file mandates fixed Korean response templates and, when enabled, requires foreign names and companies to be rendered in Korean reading/transliteration. This is a language/locale constraint applied by default, and the document does not present it as a user-selectable language preference for interaction output.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The natural-language-oriented config keys "koreanReading" and "koreanStyleName" are enabled, which suggests the skill may enforce a specific language or locale behavior. In this file there is no indication that Korean formatting is optional or limited to a justified region-specific use case.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This reference explicitly documents creating and updating Google Contacts, including uploading a contact photo, but contains no user-safety guidance or requirement for explicit confirmation before modifying user data. In the context of a skill that auto-detects business cards and saves contacts, this omission increases the risk of unintended writes to a user's address book, privacy issues, and persistent data corruption from OCR mistakes.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

## 매 세션 시작 시

1. `SOUL.md` 읽기
2. `skills/bizcard/SKILL.md` 읽기
3. `skills/bizcard/config.json` 읽기

## 절대 금지

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

## 매 세션 시작 시

1. `SOUL.md` 읽기
2. `skills/bizcard/SKILL.md` 읽기
3. `skills/bizcard/config.json` 읽기

## 절대 금지

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

## 매 세션 시작 시

1. `SOUL.md` 읽기
2. `skills/bizcard/SKILL.md` 읽기
3. `skills/bizcard/config.json` 읽기

## 절대 금지

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly states it will save extracted business-card data to Google Contacts, which transmits personal data to an external service, but the markdown does not require a clear user-facing privacy notice before transmission. Because business cards contain names, phone numbers, emails, and company details, silent transmission can violate user expectations and privacy requirements even if the user initiated scanning.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The duplicate-search step sends contact data such as a person's name to the Google Contacts API before the user approves saving, yet the workflow does not require a user-visible warning that this lookup transmits personal data externally. This creates a privacy issue because sensitive contact information is disclosed during a pre-save check, not just at final save time.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The natural-language guidance strongly prescribes Korean-specific name formatting and Korean reading behavior, including examples and rules for non-Korean business cards, but does not indicate that users can opt into this locale behavior or that the skill is explicitly limited to a Korean-market use case. That can conflict with language/locale policy expectations when locale-specific behavior is enforced by default.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The tone section requires the agent to use informal Korean speech unconditionally. This imposes a specific language and register without offering user opt-in or indicating that the skill is limited to a Korean-only context.

Static analysis

No suspicious patterns detected.