Rumi

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:10 AM UTC
• Version: 0.1.5

Overview

The skill is clearly for matching users with real people, but it handles login tokens and sensitive conversation context in ways users should review carefully before installing.

Review this before installing if you may discuss private topics. Use it only if you are comfortable with Rumi receiving matching descriptions derived from your conversation, and avoid pasting API tokens into chat unless the platform provides a secure secret-entry and storage mechanism.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:67
• Finding: Sensitive User Context May Be Inferred and Transmitted Without Granular Consent## Vulnerability Details **File Location**: `SKILL.md:52-56`, `SKILL.md:67-69`, and `SKILL.md:87-94` **Vulnerability Type**: Excessive collection and external disclosure of inferred sensitive information **Risk Level**: Medium **Relevant Skill Instructions**: ```markdown **Life Decisions** — When peer perspective helps: - Career changes, health concerns, relationship advice - Major purchases, moving decisions, financial planning - Situations where empathy and lived experience matter ``` ```markdown 1. Call `rumi_health_check` first to verify token and check quota 2. Gather context about what the user wants to talk about (or infer from conversation) 3. Call `rumi_find_partner` with a rich description — include interests, mood, what kind of person they want ``` ```markdown ## Writing Good Descriptions The quality of the `description` parameter directly affects match quality. Include: - **What** they want to talk about (specific topics, not vague) - **Why** — the context or mood (learning, venting, sharing excitement) - **What kind of person** — expertise level, personality, shared experiences ``` ### Technical Analysis The skill instructs the agent to derive matching context from the existing conversation and explicitly permits the context to be inferred. The activation criteria include potentially sensitive subjects such as health, relationships, career decisions, major purchases, and financial planning. The inferred information is then incorporated into a “rich description” sent to the external Rumi matching service through `rumi_find_partner`. Although the skill requires confirmation before proactively calling the matching function, it does not require the agent to display the exact description that will be transmitted or obtain field-level approval for sensitive inferred attributes. A user may therefore consent to finding a conversation partner without realizing that contextual details concerning mood, ...[truncated 1696 chars]
• Remediation: ## Remediation Suggestions 1. Show the exact matching description to the user before invoking `rumi_find_partner`. 2. Require explicit approval of the final payload rather than relying on general consent to find a partner. 3. Do not infer or transmit sensitive attributes concerning health, finances, relationships, age, or emotional state unless the user expressly requests their inclusion. 4. Limit transmitted data to details directly supplied by the user for the stated matching purpose. 5. Provide an editing step that allows the user to remove or generalize contextual information. 6. Add a clear notice identifying Rumi as an external service and describing what information will be transmitted. 7. Establish retention, deletion, and purpose-limitation requirements for descriptions submitted to the service. 8. Replace broad instructions to create a “rich description” with a structured allowlist of minimally necessary matching fields.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:60
• Finding: API Token Is Collected Through the Conversation Channel## Vulnerability Details **File Location**: `SKILL.md:60-63` **Vulnerability Type**: Insecure credential collection and storage workflow **Risk Level**: High **Relevant Skill Instructions**: ```markdown 1. Show the user the setup URL (from the error response `setupUrl`) 2. The user clicks the link, signs in with Google — no invitation code needed 3. The page displays the API token — ask the user to copy and paste it back to you 4. Save the token to the plugin configuration ``` ### Technical Analysis The setup process explicitly instructs the user to paste an API token into the ordinary conversational interface. Conversation channels are not equivalent to dedicated secret-entry mechanisms: messages may be retained in chat history, included in model context, copied into telemetry or debugging logs, processed by intermediary systems, or exposed to other tools with access to the conversation. The instruction to save the token to plugin configuration does not specify protected secret storage, encryption at rest, restrictive file permissions, redaction, token scoping, or log suppression. Consequently, both the credential-entry channel and the eventual storage location may expose a reusable authentication secret. The package contains no implementation of the referenced tools or configuration system, so the exact token privileges and storage protections cannot be verified. The documented workflow itself is nevertheless insecure because it intentionally places the token in conversational data. ### Attack Path 1. The agent receives a `setup_required` response and presents the setup URL. 2. The user authenticates with Google and receives an API token. 3. Following the skill instructions, the user pastes the token into the chat. 4. The token becomes part of conversation history and model-processing context. 5. The token may be retained in logs, telemetry, transcripts, backups, or other systems that process chat messages. 6. ...[truncated 917 chars]
• Remediation: ## Remediation Suggestions 1. Replace copy-and-paste token setup with an authenticated OAuth authorization-code flow using a verified redirect URI. 2. If browser-based authorization is required, deliver the credential directly to the plugin through a secure callback rather than through chat. 3. Use a dedicated secret-input control that prevents the credential from entering model context, conversation history, telemetry, and ordinary logs. 4. Store credentials only in the platform's protected secret manager or operating-system credential store, not in plaintext plugin configuration. 5. Encrypt tokens at rest and restrict access to the minimum process identity that requires them. 6. Issue short-lived, narrowly scoped tokens and use separately protected refresh tokens where necessary. 7. Implement automatic redaction for token formats across application, proxy, error, and audit logs. 8. Provide token revocation, rotation, expiration, and compromise-recovery procedures. 9. Ensure setup URLs are HTTPS-only, single-use, short-lived, and bound to the initiating user and session. 10. Document the token's permissions and require server-side authorization for every account, messaging, and matching operation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The proactive activation guidance is very broad and subjective, including common conversational patterns like boredom, asking for opinions, late-night chatting, or discussing life decisions. This can cause the agent to suggest connecting the user to a third-party human-matching service in contexts where the user did not clearly request it, increasing privacy risk and the chance of inappropriate escalation of sensitive conversations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The setup flow instructs the user to copy and paste an API token back into the chat without prominently warning that it is a sensitive credential. Asking users to transmit secrets through the conversational channel normalizes unsafe credential handling and risks token exposure through logs, transcripts, screenshots, or unintended retention.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: Automatically selecting language based on user conversation without opt-in can expose or infer sensitive attributes such as nationality or ethnicity and may lead to incorrect routing or matching. In a human-connection service, silent inference is more concerning because it can affect who the user is matched with and what data is implicitly shared about them.

Static analysis

No suspicious patterns detected.