T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:888- Finding
Full Persistent User Profile Is Disclosed to a Default External-Model Sub-Agent
- Content
View full analysis
- Remediation
View remediation
Security audit
Writing Triadic
Security checks for vulnerabilities and agentic risk
Overview
This writing skill is coherent, but it makes misleading privacy promises while automatically sending and storing sensitive writing profiles through external-model sub-agents by default.
Review this skill carefully before installing. Use it only for writing you are comfortable having processed by the configured model provider, or switch all roles to local privacy mode before sharing sensitive drafts. Expect it to create persistent writing profiles and session files under the writing workspace; inspect or delete MEMORY.md, session folders, and the knowledge base if you do not want long-term profiling.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:876- Finding
Persistent Preference Learning Uses Opt-Out Consent and Treats Silence as Acceptance
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
PRIVACY.md:24- Finding
Documented Retention Limits Are Not Enforced and Conflict with Indefinite Storage Instructions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (52)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- name: writing-triadic version: 2.10.0 license: MIT
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill makes strong privacy assurances that data stays local and is not uploaded to external models, yet later instructs the system to send session content, drafts, and even MEMORY.md-derived material to spawned sub-agents using named external models. This creates a direct contradiction that can mislead users into sharing sensitive writing samples or preferences under false assumptions about where their data goes.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The style-clone workflow directs extraction of a detailed writing fingerprint from user samples and permanent storage in MEMORY.md after confirmation of the fingerprint summary, but it still does not clearly warn that the sample-derived profile will be retained and reused persistently. Writing style can function as a behavioral biometric or sensitive profile, so storing it long term without explicit retention disclosure increases privacy and misuse risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The prompt automatically launches an analysis process and merges results into persistent memory and a knowledge base without notifying the user. Automated secondary processing and propagation into multiple stores materially increases data exposure, creates unclear data lineage, and may cause private user-derived information to persist beyond the original writing task.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Line L039 states that the skill previously used the category "Non-Chinese users," which is a natural-language classification based on nationality/geography. Even though the entry says this was fixed, the file still contains the policy-violating phrasing in user-visible text, which is relevant under the natural-language policy review scope.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## 3. Web Research (Network Transmission) **Writing Triadic NEVER transmits your data without asking first.** Before performing any web research: 1. The Creator will **explicitly ask** for your consent
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## 7. What This Skill NEVER Does - ❌ Send your data to third-party servers without consent - ❌ Upload MEMORY.md or writing profiles to cloud services - ❌ Use your data to train external models - ❌ Share your preferences with other users
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README encourages invocation through very broad natural-language phrases like '帮我写...' and '写个...'. In assistants that auto-route skills based on loose utterance matching, these generic examples can cause unintended activation during ordinary conversation, leading the skill to read or persist user writing preferences and potentially begin research or drafting flows without clear user intent for this specific skill.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly describes extracting and reusing preferences, corrections, style drift, adoption rate, vocabulary heatmaps, and veto signals, which implies persistent profiling of user behavior and writing style. If handled without clear consent, minimization, retention limits, and access controls, this can expose sensitive personal patterns and proprietary writing samples across sessions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises activation via broad, ordinary writing requests without clearly bounding when the skill should engage or what capabilities it will use. Ambiguous trigger scope can cause unintended invocation on sensitive user prompts, increasing the chance of unnecessary data collection, research activity, or persistent memory updates the user did not explicitly request.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow describes web research, knowledge-base updates, and evolution archive reads/updates but does not warn users that their prompts, style samples, or derived preferences may be retained or sent to external services. This creates a privacy and consent gap: users may unknowingly expose sensitive content or have it stored across sessions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow states that the Evolution Analyst updates memory and statistics from user interactions, confirming ongoing persistence of behavioral and preference data. In context, this is more dangerous because the skill is designed for everyday writing tasks, which may include resumes, reviews, internal reports, and other sensitive personal or business content.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The document claims sub-agents receive only the minimum necessary data and restricts the Reader from getting complete MEMORY.md, but the Executor is instructed to receive full writing rules that explicitly include auto-injected historical preferences from MEMORY.md. This broadens disclosure of persistent user preference data beyond what users may expect and weakens the stated data-minimization guarantees.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger conditions are broad enough to activate on common writing-related phrases such as 'write', 'article', or vague ideas, increasing the chance the skill runs when a user did not intentionally invoke it. In this skill, unintended activation matters because the workflow includes reading persistent memory, creating session files, and potentially initiating consent prompts for external research.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The rule "语言:中文 / 英文 / 混合" defines a constrained language set in the protocol, while the document overall is heavily Chinese-oriented and does not clearly state that language selection is always user-chosen. This can conflict with language/locale policy expectations unless the skill explicitly offers the user a language choice or documents a justified locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document states it targets writing from the dimension of '双语混淆' and instructs executors to strictly avoid it while readers should harshly deduct points. This becomes a natural-language policy issue because it imposes a specific language/style norm on outputs rather than offering a user choice or documenting a justified locale-specific requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The scoring table assigns penalties for '英文思维写中文', '中文思维硬译英文', and mixed Chinese/English stylistic divergence. Penalizing these forms as a universal rule can violate language/locale neutrality when no opt-in or scope limitation is provided.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The prompt explicitly instructs the agent to read and update persistent memory files before and after writing sessions, but provides no user-facing notice, consent step, or retention boundary. This creates a privacy and data-governance risk because user preferences, corrections, and behavioral profiles may be stored and reused invisibly across sessions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The prompt promotes ongoing collection and reuse of user history, dislikes, correction records, and template habits in MEMORY.md without defining clear minimization, purpose limitation, or retention boundaries. Even if intended for personalization, broad undefined accumulation of behavioral data creates avoidable privacy and governance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill mandates silent pre-question access to MEMORY.md and instructs the model to naturally incorporate prior-session information without revealing that it was consulted. Hidden retrieval of prior user data undermines transparency and can expose sensitive historical preferences or corrections in contexts where the user does not expect cross-session memory access.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The style-clone feature instructs extraction of an 8-dimensional writing fingerprint from long user samples and storage as a reusable profile. This expands the system from simple personalization into persistent profiling, which is more sensitive because stylometric features can uniquely characterize a user and be reused across contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The prompt requires automatic creation or update of session-state.md containing session metadata, module usage, and decision logs, yet does not inform the user that session artifacts will be written to disk. This hidden persistence can reveal workflow details, user choices, and potentially sensitive context that may later be accessed by other components or operators.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The session-state and preference-injection design encourages stored user history to be propagated into later artifacts and handed across roles, increasing the number of locations where user-derived data may appear. Broader propagation raises the chance of overexposure, accidental leakage, and use beyond the user's original expectation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill tells the agent to log user negative feedback into 用户反馈.md and later persist it, but gives no notice that criticism, corrections, or preferences will be recorded across sessions. Feedback logs can contain sensitive judgments, style preferences, or personal context, and invisible retention may violate user expectations and privacy requirements.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The prompt explicitly instructs the sub-agent to analyze complete writing session data and convert it into long-term structured memory. Persisting broad session content by default can capture sensitive user inputs, proprietary drafts, or personal preferences beyond what is necessary, creating privacy and data-retention risk.
- Content
Static analysis
No suspicious patterns detected.