Security audit

Fragment Thoughts Organizer En

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-only notes skill that handles personal fragments as expected, with privacy caveats around retention and later resurfacing.

Install only if you are comfortable with the agent retaining and later quoting personal fragments. Avoid putting secrets, credentials, or highly sensitive personal details into fragments, and review any connected note-tool permissions before allowing sync.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill says 'Say any of the following and the guide picks it up' and includes triggers like 'Quick note', 'What have I been thinking about this week', and 'Untangle my brain, it's a mess.' These are broad conversational phrases that could easily occur in ordinary chat, and the file does not provide negative examples or clear constraints to distinguish when the skill should activate versus when the user is speaking generally.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to preserve and echo user content verbatim over time. That creates a natural-language data retention and resurfacing channel: if users enter secrets, health details, or other sensitive fragments, the agent is encouraged to reproduce them later, potentially to the wrong audience or in an unintended context.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Cross-period retrieval is designed to pull prior fragments and include original quotes, which directly instructs the agent to expose accumulated user data from memory or logs. In a reflective notes skill, this behavior is core functionality, but it also materially increases privacy risk because historical content may be surfaced without sufficient minimization or audience checks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill discusses storage behavior only in the FAQ and notes that conversation history may serve as the fragment log and that connected note tools may receive data. Without a prominent up-front warning, users may unknowingly submit sensitive personal information under the false assumption that it is ephemeral, increasing privacy and inadvertent disclosure risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: By framing conversation history itself as the fragment log and allowing sync into external note tools, the skill normalizes persistent retention of everything the user shares. This expands the data exposure surface beyond the immediate chat, raising risks of unintended disclosure, over-retention, and propagation into third-party systems with different access controls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The markdown says the guide is produced when the user says "organize today" or "untangle my day," but it does not define boundaries, exclusions, or context for when these phrases should or should not invoke the skill. These phrases are natural conversational language and could overlap with ordinary requests, making unintended activation more likely.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The example output explicitly adds a new synthesized judgment in 'The Most Notable One Today' while the skill description promises preservation of original fragments and avoidance of drawing conclusions. This creates specification drift that can cause the agent to infer, attribute, or transform user meaning beyond the source material, which is risky for fidelity-sensitive journaling and memory workflows.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation says every entry preserves original words and forbids summarizing, yet the example introduces normalized labels and an inferred insight not present in the fragment log. This inconsistency can mislead downstream agents or users into trusting outputs as verbatim records when they actually contain model-added interpretation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example uses very broad trigger phrases like "what have I been thinking about lately" and "any connections in my fragments," which can activate the skill in ambiguous situations without clear user intent boundaries. In a journaling/reflection skill, that can cause the agent to retrieve and synthesize sensitive recent fragments too eagerly, increasing the chance of unintended disclosure, over-collection, or responding in contexts where the user did not explicitly request this analysis mode.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The phrase 'untangle my day' is ambiguous and could reasonably mean summarizing, emotional support, planning, or general conversation rather than strict fragment archiving. In this skill context, that ambiguity is more dangerous because the content involves personal reflections and named individuals, so accidental invocation could lead to unexpected categorization, retention, or synthesis of sensitive material.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The phrase 'untangle my day' is ambiguous and could reasonably mean summarizing, emotional support, planning, or general conversation rather than strict fragment archiving. In this skill context, that ambiguity is more dangerous because the content involves personal reflections and named individuals, so accidental invocation could lead to unexpected categorization, retention, or synthesis of sensitive material.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The method claims the archive must be a factual listing with no narrative, reflection, summary, or conclusion, but later requires a distilled 'Most Notable One Today' item that may be newly synthesized. That creates instruction drift: the skill can start inferring and elevating an interpretation as if it were part of the archival task, which risks misrepresenting user intent and producing conclusions the skill metadata explicitly says it should avoid.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This section instructs the assistant to generate a new 'notable' insight that 'grew today' and may not have existed in the original fragment log. In the context of a skill whose purpose is to preserve fragments and surface connections without drawing conclusions, this is a substantive expansion of scope into interpretation, creating risk of fabricated or overconfident inference about the user's thoughts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger guidance includes broad natural-language phrases like "what have I been thinking about" and "any connections in my fragments," which plausibly overlap with ordinary user conversation rather than a narrowly scoped command. This can cause unintended activation of the cross-period analysis behavior, leading the agent to surface historical fragments and derived connections when the user did not explicitly intend that mode.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README states the skill language is 'English' and redirects Chinese users to a separate version, which imposes a language constraint rather than offering an in-skill choice. This matches the policy concern for locale or language restrictions without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file describes retrieving a user's fragments over multiple days and surfacing connections, including personal reflections, contacts, and phone conversations. The description does not include any warning that the skill handles potentially sensitive personal data or that summaries may expose private context.
Content: No source excerpt is available for this finding.