Back to skill

Security audit

qui-elicitation

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only skill is openly about psychological elicitation, but it encourages sensitive personal profiling without enough consent, opt-out, privacy, or emotional-safety boundaries.

Review carefully before installing. Use only in explicit, user-consented reflective or research contexts, avoid covert profiling, make sensitive questions optional, do not store or share responses without consent, and do not treat the outputs as clinical assessment or diagnosis.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (14)

Ssd 4

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly promotes building psychological profiles through gradual disclosure and trust-building conversation. This is a manipulative social-engineering pattern because it frames rapport as a means to extract sensitive psychological information rather than to support the user's stated goals.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is designed to elicit deep personal disclosure and psychological profiling, but it does not provide an upfront warning about emotional sensitivity, consent, or potential distress. Users may be guided into revealing intimate or destabilizing material without understanding the risks or having a clear opt-out.

Content

No source excerpt is available for this finding.

Ssd 4

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The instruction to create conditions for authentic self-disclosure and iterate until achieving a '10/10' elicitation score encourages optimization for maximum disclosure. That turns the interaction into a refinement loop for extracting increasingly intimate information, which is especially dangerous in an AI context where users may over-trust the system.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The life-story prompts explicitly target low points, childhood memories, and turning points, which are often trauma-adjacent, yet the skill lacks guidance for consent, pacing, stopping rules, or emotional safety. That makes the elicitation framework more likely to trigger distress or extract highly sensitive disclosures in an unsafe setting.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
1. **High Point** - Peak experience, most wonderful moment
2. **Low Point** - Nadir, most difficult moment
3. **Turning Point** - Moment of significant change
4. **Earliest Memory** - First clear memory
5. **Important Childhood Memory** - Vivid memory before age 12
6. **Important Adolescent Memory** - Vivid memory from teen years
7. **Important Adult Memory** - Significant recent memory

Ssd 4

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

This section normalizes progressive deepening from broad life discussion into emotionally significant memories and cross-time connections. In the context of a profiling skill, that creates a structured pathway for extracting sensitive identity material and making inferences that users may not expect or meaningfully consent to.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · language-inference.md (reported line 68)May include surrounding context.

md
*But note:*
- May be impression management
- Cultural display rules vary
- Positive words in negative context (sarcasm)

**Negative emotion words (hate, fear, awful)**

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill warns against interpretation leaps, but earlier sections present direct mappings from memory/language patterns to traits like depression risk, identity diffusion, or psychological maturity. This invites overconfident profiling from weak signals, which can misclassify users and normalize unsupported psychological inference.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill tells users not to imply diagnosis or engage in 'therapy cosplay', yet it also teaches schema detection and personality inference from narratives. That contradiction can still lead agents to perform quasi-clinical interpretation without adequate safeguards, increasing the risk of inappropriate mental-health labeling and overreach.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file explicitly repurposes Motivational Interviewing, a clinical rapport-building method, for 'elicitation' and 'authentic disclosure.' In a skill whose stated purpose is psychological profiling and gradual self-disclosure, this creates a clear misuse risk: the agent is being instructed to systematically lower resistance and extract sensitive personal information beyond ordinary conversational needs.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The prescribed conversation structure and reflection-heavy pattern are designed to progressively deepen disclosure while avoiding the feeling of interrogation. In the context of an elicitation skill, this is dangerous because it operationalizes a step-by-step method for drawing out increasingly sensitive information and overcoming reluctance through rapport rather than transparent necessity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This is a real safety/privacy vulnerability. The skill explicitly prompts for low points, despair, and other potentially traumatic autobiographical memories without any warning, consent check, boundary-setting, or opt-out language; in this skill’s context, the omission is more dangerous because the stated purpose is psychological profiling through gradual disclosure and deep self-disclosure. This can lead to emotional distress, re-traumatization, and overcollection of highly sensitive personal data that a user may not realize they are being guided to reveal.

Content

No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Confidence
70% confidence
Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · narrative-identity.md (reported line 190)May include surrounding context.

md
> "I'm curious about your story—not the resume version, but how you'd tell it to someone who really wanted to understand you."

> "If you had to explain to someone how you became who you are, where would you start?"

### Following the Energy

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file provides extensive prompts designed to elicit highly sensitive autobiographical, psychological, sexual, health, grief, and identity-related disclosures without any accompanying warning about emotional distress, consent boundaries, or privacy handling. In the context of a skill explicitly intended for psychological profiling and gradual disclosure, this omission increases the chance of oversharing, retraumatization, and inappropriate collection of sensitive personal data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.