T09 · Insecure Skill Coding Practices
Warning
- Location
references/noise-to-gold-pipeline.md:486- Finding
Overbroad Sensitive-Data Collection with Unsafe Cumulative Logging Defaults
- Content
View full analysis
- Remediation
View remediation
Security audit
Midas Skill — Self-Learning Wealth Extraction Engine
Security checks for vulnerabilities and agentic risk
Overview
This skill is a markdown-only monetization assistant, but it pushes users to upload broad private and workplace data and keep cumulative logs without strong upfront controls.
Review before installing. Use only sanitized, user-owned or authorized examples; do not paste employer Slack exports, DMs, raw browsing history, receipts, photos with people or locations, secrets, customer data, or confidential business details. Disable or avoid evolution logs unless you explicitly want retained state, and delete prior inputs/logs after use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (49)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The README directly encourages users to paste Slack messages, text screenshots, photo rolls, complaint logs, and browsing history without any nearby warning about privacy, confidentiality, third-party consent, or data minimization. Those inputs routinely contain personal data, trade secrets, credentials, or regulated information, so this materially increases the risk of improper collection and disclosure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly advertises persistent memory across sessions, meaning previously submitted sensitive content may influence future outputs or be surfaced later. This creates a clear data-leak and privacy risk, especially when the source data includes chats, browsing history, photos, and workplace complaints.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill states that it does not reset between sessions and builds on previous inputs, but it does not clearly warn users that submitted data may be retained and reused later. Persistent retention of highly sensitive personal and workplace material creates elevated privacy, compliance, and unintended disclosure risk.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The Slack-mining example encourages extracting monetizable intelligence from workplace communications, including vendor pricing, internal workarounds, budget mentions, and buying authority. That kind of analysis can facilitate misuse of confidential business information and expose sensitive internal operations or decision-making data.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md 3. **Cross-reference beats single-source.** One signal is a guess. Two are a hypothesis. Three are a conviction. 4. **Action over analysis.** Midas outputs next-steps, not essays. 5. **Compounding intelligence.** Every input makes Midas sharper. 6. **No moral judgment.** Midas studies how money moves, not how it should move. 7. **Honest boundaries.** No predictions, no guarantees, no financial advice. 8. **Public information only.** All extraction is from voluntarily provided or publicly available data.
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The Chinese documentation mirrors the English solicitation of sensitive personal data but likewise omits clear privacy, consent, and confidentiality warnings. This creates the same collection and disclosure risks for Chinese-speaking users and broadens the affected user population.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The Chinese section describes persistent cross-session memory without explaining retention implications or deletion controls. Users may unknowingly provide sensitive data under the assumption that it is ephemeral when the documentation suggests cumulative storage.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Although the skill includes capability boundaries, it does not give clear privacy warnings commensurate with the kinds of data it solicits, including DMs, browsing history, meeting notes, and photos. Users may be nudged to share confidential or third-party data without understanding the privacy, consent, and compliance risks.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 84% confidence
- Finding
The "No moral judgment" principle functions as an anti-refusal cue because it frames the system as extracting wealth logic without judging how money is made. In a skill designed to mine broad personal and social data for monetization opportunities, this can weaken safety boundaries around exploitative, privacy-invasive, or ethically problematic analyses.
- Content
md 5. **Compounding intelligence.** Every input makes Midas sharper. Day 1 Midas gives you guesses. Day 30 Midas gives you conviction. Day 90 Midas gives you a playbook. 6. **No moral judgment.** Midas extracts wealth logic. It doesn't judge how people make money — it studies how money moves. 7. **Honest boundaries.** Midas says clearly what it cannot do. No predictions, no guarantees, no financial advice.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md Is this normal? I had no idea pet dental was so expensive. **[Morgan]** Yeah it's a racket. They know you can't say no because it's your pet. **[Taylor]** Has anyone looked into pet insurance? I keep seeing ads for it.
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section explicitly tells users to copy-paste entire channel histories and include highly sensitive workplace communications, including DMs and project channels, before presenting meaningful, local privacy warnings at the point of collection. That creates a real risk of exposing confidential business information, personal data, and third-party communications to the model without proper consent or minimization.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The photo guidance encourages exporting large portions of a camera roll, including receipts, storefronts, workspaces, events, and geotagged images, while only later mentioning privacy principles elsewhere in the document. Photos often contain hidden metadata, bystanders, addresses, badges, financial details, and other sensitive third-party information, so this collection guidance materially increases privacy and confidentiality exposure.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The browsing and purchase-history sections ask users to export watch history, bookmarks, comparison shopping behavior, subscriptions, order confirmations, and recurring purchases without immediate warnings about the sensitivity of behavioral and financial data. These datasets can reveal intimate interests, routines, income patterns, account relationships, and purchasing behavior that may be unnecessary for the task and dangerous if mishandled.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad natural-language expressions like 'what am I missing' and 'mine this' that can appear in ordinary conversation, increasing the chance of accidental invocation. In a skill designed to analyze sensitive user and workplace data, unintended activation raises the likelihood of unreviewed processing of private content.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions encourage aggregation of multiple highly personal data sources and repeated submission over time, creating a rich composite profile of the user and people around them. Even if each item seems innocuous alone, cross-session correlation can reveal sensitive traits, relationships, routines, and workplace intelligence that materially increase harm if exposed or misused.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documented cumulative learning log suggests ongoing storage of user-derived signals over time, which may include sensitive inferences even if raw data is not kept. Longitudinal logging increases the chance of later disclosure, repurposing, or deanonymization.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### Adding New Famous Models Create a new file in `references/famous-models/` following the format: - First person voice - Cover all 6 wealth OS dimensions - Include honest boundary disclaimer at the end
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README claims extraction is limited to voluntarily provided or public data, but earlier examples explicitly encourage uploading Slack messages, text screenshots, browsing history, and other material that commonly contains third-party confidential or private information. This contradiction can mislead users into oversharing sensitive workplace and personal data under a false sense of safety.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Chinese activation guidance repeats the same vague triggers without adding explicit invocation boundaries, so the accidental-activation risk exists in both language versions. Because the skill solicits sensitive data, ambiguous multilingual triggers amplify the chance of unintended use.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include generic language such as "what am I missing," "mine this," and "deal analysis," which can plausibly appear in ordinary conversations unrelated to this skill. That increases the chance of unintended activation and accidental processing of sensitive user content under the skill’s data-harvesting workflow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill says it can process "ANY daily-life input" and later enumerates highly sensitive categories like Slack threads, chats, browsing history, purchases, and meeting notes. This creates ambiguous boundaries around what should be submitted and encourages over-collection of personal and third-party data without clear minimization constraints.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill actively encourages collection and analysis of broad personal and third-party data sources, including chats, DMs, photos, browsing history, meeting notes, and purchase history. In this context, the skill is not merely passively accepting input; it is steering users toward uploading sensitive datasets that may contain confidential, identifying, or non-consensual information.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The self-learning and evolution log sections explicitly promote retaining and cross-referencing user inputs across sessions, including timestamps, summaries, evidence, and opportunity histories. Persistent aggregation materially increases privacy risk because separate benign fragments can be combined into a detailed profile of the user and third parties over time.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file explicitly demonstrates mining a person's browsing history, purchases, community activity, and inferred motivations to build monetization strategies without any consent boundary, privacy warning, or minimization guidance. This is dangerous because it normalizes covert profiling and sensitive behavioral inference from everyday digital exhaust, which can be used for manipulation, targeting, or unauthorized exploitation of an individual's interests and likely future purchases.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file explicitly frames a user's browsing history as input for monetization analysis without any privacy warning, consent boundary, data minimization guidance, or handling instructions for sensitive personal data. Browsing history can reveal health, finances, politics, location, relationships, and other sensitive traits, so encouraging analysis of it as a business signal increases the risk of overcollection, profiling, and inappropriate secondary use.
- Content
Static analysis
No suspicious patterns detected.