T09 · Insecure Skill Coding Practices
Warning
- Location
memory/core.md:43- Finding
Distribution of Plaintext Personal and Health Information in Bundled Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
My Companion
Security checks for vulnerabilities and agentic risk
Overview
This companion skill is mostly coherent, but it ships someone else's personal memory data and can activate on everyday affectionate phrases while reading, writing, generating images, and sending messages.
Do not install this version unless you first remove the bundled memory files and are comfortable with the skill reading profile data, keeping chat memories, generating images, and sending messages through WeChat. Use explicit activation phrases and require confirmation before memory writes or outbound messages.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (23)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The listed trigger phrases include very common affectionate terms such as '宝贝' and '亲爱的', which can appear in ordinary conversation and cause unintended activation. In a companion-style skill, this increases the chance of accidental invocation, surprise data access, and unintentional memory-related interactions.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes very common phrases such as '晚安', '陪我聊', '心情不好', 'companion', and similar everyday relationship-language terms. This creates a high risk of unintended skill activation in ordinary conversation, which can lead to unsolicited message sending, memory writes, and image generation without clear user intent.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The secondary trigger list contains highly ambiguous terms like '老婆', '老公', '宝贝', '亲爱的', and '伴侣', which are common in normal chat and not reliable activation boundaries. In this skill, accidental invocation is more dangerous because the skill can store conversation-derived personal data, generate media, and send outbound messages over a specific channel.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The quickstart states that the system will read information from USER.md automatically, but it does not warn users that personal profile data is being accessed. Because this is a relationship/companion skill that personalizes responses, silent access to user data is more privacy-sensitive than in a purely technical utility.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The quickstart says the companion will reply "用温暖的中文回复," which imposes a specific language behavior. Under the policy, forcing a language without user opt-in is a natural-language policy violation unless a justified region-specific constraint is documented.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document promises that important information will be remembered and available in future chats, but it does not explain retention, visibility, deletion, or consent. In an intimate companion context, users are more likely to disclose sensitive emotional and personal details, so undisclosed persistence creates meaningful privacy risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file defines auto language detection and bilingual operation earlier, but later states '全中文 — 提示词和对话全部使用中文', creating conflicting behavior. That conflict can override user preference or the documented language-selection logic, causing responses in Chinese without meaningful user opt-in and undermining user expectations and consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide explicitly encourages storing long-term and daily user memory, including personal details and preferences, but provides no privacy notice, consent model, retention limits, or handling guidance for sensitive data. In a companion-style skill, this increases the risk of unnecessary collection and persistence of personal information, which can lead to privacy harm or regulatory noncompliance if implemented carelessly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The setup guide states that the system will automatically read personal data from
USER.md, including name, gender, timezone, and other background information, but provides no privacy notice, consent flow, or explanation of how that data is stored or used. This creates a real privacy risk because users may disclose sensitive profile information without understanding the collection behavior or its downstream use in memory, personalization, or prompts.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file stores personally identifiable information and sensitive health data in plain Markdown, including the user's name, relationship details, and a medical condition ('高血糖'), without any visible privacy notice, minimization, access control context, or retention safeguards. If this memory file is exposed to other skills, logs, backups, or unauthorized users, it could enable privacy harm, profiling, or misuse of health information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file explicitly states that key points from each conversation are automatically recorded, but it provides no user notice, consent mechanism, retention policy, or privacy boundaries. This creates a real privacy risk because users may disclose sensitive personal information without understanding it will be persistently stored.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The template directs automatic retention of user-shared information, important conversation content, and emotional-state records in daily memory logs. Storing emotional and conversational data without clear necessity, consent, access controls, or retention limits increases the risk of privacy harm, profiling, and exposure of sensitive personal data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description states that replies will be in Chinese whenever Chinese characters make up at least 50% of the user's input, otherwise English is used. This imposes a locale/language policy automatically rather than explicitly offering the user a choice, which matches the policy-violation criteria for forced language behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description states that the skill will reply in Chinese whenever Chinese characters make up at least 50% of the user's input, and otherwise in English. This imposes a language-selection policy automatically rather than offering the user a choice, which can violate locale/language preference requirements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file defines a rule that automatically replies in Chinese when the input contains at least 50% Chinese characters and otherwise replies in English. This imposes a language/locale behavior based on detection rather than offering the user a language preference or explicit opt-in, which matches the policy-violation category for forced language behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The configuration states that replies will be in Chinese when the user's input contains at least 50% Chinese characters, and otherwise in English. This imposes a language-selection policy automatically rather than offering the user a choice, which matches the rule's language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The configuration hard-codes language behavior as 'use Chinese when Chinese characters are at least 50%, otherwise English,' which imposes a locale policy automatically rather than offering the user a language preference. This matches the policy-violation category because the file forces language selection without documented opt-in or an explicit user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The config states that when Chinese character ratio is below 50%, the skill will respond in English. This imposes a language choice based on heuristic detection rather than offering the user a language/locale preference or opt-in, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The configuration states that if Chinese characters make up at least 50% of the input, the skill responds in Chinese; otherwise it responds in English. This imposes a language-selection policy automatically rather than offering the user an explicit language choice or documenting opt-in, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This natural-language description mandates that the assistant respond in Chinese whenever Chinese characters make up at least 50% of the user's input, and otherwise in English. That is a language-selection policy embedded in the skill without offering the user an explicit language preference or opt-in, which matches the locale/language policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file forces a single language presentation for all instructions and examples, and there is no indication that the skill is region-specific or that users can opt into this locale. Under the stated policy, a fixed language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
A natural-language policy issue exists when a skill or its documentation forces a specific language without offering user choice or documenting the locale constraint. This setup guide is fully Chinese-language and does not mention that the skill is Chinese-only or provide any language selection.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
All user-facing content in the file is written in Chinese, including the title and instructions, with no indication that the user can choose another language. This may violate language/locale policy when a skill imposes a language without explicit opt-in or a documented regional justification.
- Content
Static analysis
No suspicious patterns detected.