Glow

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 1.0.3

Overview

This skill matches its Glow dating/networking purpose, but it asks agents to set up recurring remote-updated checks that access sensitive messages and profile data.

Review before installing. Only enable the heartbeat if you are comfortable with periodic access to Glow messages and introductions, and avoid any setup that fetches and follows remote instructions automatically. Use explicit Glow-specific requests, keep the API key scoped and revocable, choose restrictive photo privacy settings, and register webhooks only to callback URLs you control.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: heartbeat.md:9

Finding

Persistent Execution of Remotely Mutable Heartbeat Instructions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: skill.md:42

Finding

Unpinned Registry-Based Skill Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The photo upload endpoint sends user images to an external service and defaults privacyLevel to 'glow_can_share', yet the description does not provide a strong user-facing warning about the sensitivity of images or the consequences of the default sharing behavior. In a dating/intro platform, photos are highly sensitive biometric and personal data, so silent or unclear upload/share semantics materially increase privacy harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The webhook registration endpoint allows forwarding event data to a user-supplied callback URL but does not explicitly warn that messages, match activity, or negotiation-related events may be sent off-platform to another external destination. This creates substantial privacy and exfiltration risk, especially because the callback target is arbitrary and the event set suggests potentially sensitive social and communication metadata.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list includes very broad, common phrases such as "dating," "friends," "networking," and "meet people," which can cause the skill to activate in conversations where the user did not intend to invoke this specific service. In a social-connection skill, unintended activation is especially sensitive because it may steer users into sharing personal relationship, social, or professional information with a third-party service without clear intent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skill.md (reported line 286)May include surrounding context.

md

**PATCH /api/v1/intents/{id}** — Update an intent (use `{ "status": "paused" }` to pause)

**DELETE /api/v1/intents/{id}** — Permanently delete an intent

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skill.md (reported line 367)May include surrounding context.

md

- `privacyLevel` (optional): `glow_can_share` | `ask_before_sharing` | `only_i_can_share` | `hidden`
- `isPrimary` (optional): `true` to make primary

**DELETE /api/v1/photos/{id}** — Remove photo

**PATCH /api/v1/photos/{id}** — Update photo settings

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skill.md (reported line 389)May include surrounding context.

md

**GET /api/v1/webhooks** — List registered webhooks

**DELETE /api/v1/webhooks/{id}** — Remove a webhook

Events: `match.new`, `match.accepted`, `match.mutual`, `message.new`, `intro.created`, `negotiation.proposal`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The heartbeat instructs periodic authenticated API calls using a bearer token to read messages, pending introductions, and account status, but it does not require explicit user consent, visibility, or a just-in-time warning before accessing private account data. In a relationship and networking context, these endpoints expose sensitive interpersonal communications and profile state, so silent polling or automatic retrieval could violate user expectations and leak highly private information through the agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This skill handles highly sensitive personal data—email, profile details, messages, photos, preferences, and introductions—but the top-level API description does not prominently warn users that this data is transmitted to and stored by an external service. In a dating/networking context, the privacy sensitivity is elevated because the data can reveal identity, relationships, location, interests, and social graph information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The free-form conversation endpoint accepts arbitrary natural-language messages and sends them to an external service, but the description does not clearly warn the user that any text they provide may leave the local assistant environment. Because users may include intimate relationship details, contact information, or other sensitive context, the absence of a clear warning increases privacy and data leakage risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes a matchmaking/account-management skill for private introductions, messaging, profiles, and settings. The webhook endpoints add a developer-style integration surface that can push real-time user events to arbitrary external URLs, which is not an obvious or necessary end-user capability for finding connections or managing a Glow account.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill introduces itself as helping users find connections but does not provide a prominent upfront warning that using it may send sensitive personal data such as email, name, relationship preferences, lifestyle details, and messages to an external service. In this context, the omission can undermine informed consent and lead users to disclose intimate information without understanding the privacy implications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger list contains broad everyday phrases like finding friends, networking, or meeting people, which can cause the skill to activate in contexts where the user did not intend to share sensitive personal data with a third-party dating/networking service. Because this skill handles highly sensitive relationship, profile, and messaging data, overbroad invocation increases the risk of accidental data disclosure and unintended account actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.