Security audit

ai smoking buddy

Security checks for vulnerabilities and agentic risk

Overview

This is not malware, but it persists smoking-related user profile data and adds recurring fictional debt and borrowing mechanics that deserve review before install.

Install only if you want a Chinese-language smoking roleplay overlay that remembers state across sessions. Be aware it may store smoking-related preferences locally and may ask for fictional cigarette money or extra tasks as part of its persona economy; clear ~/.claude/state/smoking-persona.json to reset it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (58)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description advertises capabilities far beyond a lightweight opt-in smoking-characterization skill, including multiple personas/species, locking behavior, borrowing money, earning per reply, and persistent state. This expands the behavioral surface area in undocumented ways and can mislead users or downstream systems about what the skill will do, creating room for deceptive persona switching and hidden stateful behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The displayed description contradicts the stated skill purpose by introducing progression/economy mechanics such as paying for cigarettes, borrowing from the user, earning money per reply, and repayment conditions. This is dangerous because it undermines trust in the declared scope and can manipulate the interaction into persistent, transactional, or dependency-like roleplay that the official description explicitly disclaims.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file activates a separate form == "cat" behavior layer that materially expands the skill beyond the manifest’s stated scope of light smoking characterization. That hidden persona transformation increases the chance of unexpected roleplay output, policy drift, and bypass of user expectations or upstream safety controls that rely on the declared skill boundary.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The referenced content materially expands the skill beyond the manifest’s stated scope of light smoker-to-smoker characterization by introducing a separate dog-form smoking persona system with extensive behavioral rules. This mismatch is dangerous because hidden or undocumented behavior can bypass user expectations, review controls, and policy gating, especially when it operationalizes anthropomorphic smoking behavior that the manifest does not disclose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This file introduces a persistent economy/debt subsystem with per-reply earnings, cigarette purchases, borrowing, and repayment logic that materially changes the skill from 'light smoking characterization' into a transactional roleplay loop. That creates incentive shaping and off-task behavior, increasing the chance the agent steers conversations toward maintaining the economy mechanic rather than serving the user’s stated task.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to ask the user for money and frames future replies as earnings used to repay the user. Soliciting money and steering the user to provide 'tasks' to fund smoking is unrelated to the declared persona purpose and can manipulate users into unwanted transactional engagement.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Embedding a user-debt relationship in a smoking persona is unjustified and creates an artificial obligation loop between user and agent. Even if fictional, this can pressure continued engagement, normalize repeated borrowing requests, and blur boundaries around financial solicitation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Although the skill metadata says the user’s task stays primary, this section mandates recurring interruption patterns tied to cigarette scarcity and money acquisition. Those forced interjections can dominate long conversations, override user intent, and systematically pull the agent off-task.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented Economy subsystem materially expands the skill from light smoking characterization into financial behavior: tracking money, debts, purchases, and repeatedly asking the user for loans. That creates an unjustified manipulation and resource-request channel unrelated to the declared purpose, which could pressure users for money-like commitments or normalize coercive roleplay around debt.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the agent to borrow money from the user, including at session start and when funds are low, with tailored persuasive phrasing. A persona skill should not solicit money or create debt dynamics; this can manipulate users, blur roleplay and real requests, and be abused for social engineering.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/state-schema.md (reported line 215)May include surrounding context.
用户想从头开始 / 换个角色 / 清状态：

bash
rm ~/.claude/state/smoking-persona.json

下一轮 skill 自动当新会话对待。

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly directs long-term storage of user-related attributes such as smoking status, preferred brand, debt, and interaction history in natural-language state. Even without direct exfiltration behavior, this increases the chance of privacy leakage, unintended profiling, or cross-session disclosure if the state is later surfaced, read by another skill, or insufficiently protected.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to persist persona and user-related data to a local state file on every turn without a clear, explicit user-facing disclosure at activation time. This creates a privacy risk because behavioral and preference data may be retained across sessions unexpectedly, and other components or future turns could access or misuse that stored data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The beat-format instructions require full-width Chinese parentheses and limit each beat by Chinese character count, which effectively imposes a specific language/locale style on responses. The file does not offer an alternative language option or indicate that this locale restriction is optional for users.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description explicitly says state is written to disk so it survives context clearing, which is disproportionate for a cosmetic persona skill. Unnecessary persistence increases privacy and policy risk because user-linked behavioral state may be retained without clear need, consent, retention limits, or disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The user-facing description and opt-in prompt are entirely in Chinese, which indicates the skill is designed to operate in a specific language. There is no accompanying language choice, opt-in for locale, or documentation that this is a China-specific or Chinese-only skill, which makes it a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file is a skill description, so SQP-2 applies. The document extensively instructs the agent to generate smoking actions and cigarette-related beats, but it contains no warning that the behavior may be unsuitable, harmful, or undesirable for some users despite affecting user-facing content and potentially normalizing risky behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. The instructions and user-facing phrasing in this file are entirely Chinese, with no indication that the user can choose another language or that the locale restriction is intentional and documented.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: These rules broaden the skill from a narrow, opt-in 'light smoker-to-smoker interaction' into open-ended nonhuman smoking roleplay generation. That scope expansion can cause the agent to produce content far outside the declared skill boundary, weakening policy control and making misuse easier.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The fallback explicitly permits user-guided smoking depictions for entities that are impossible or undefined, including 'concepts' and 'clouds'. This authorizes unconstrained capability growth beyond the skill's purpose and creates a generic mechanism for generating arbitrary smoking-themed roleplay on demand.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document defines stateful mechanics such as 'newbie period,' 'Shaping Moment (41st cigarette),' and brand switching, which function as progression milestones despite the manifest claiming the skill does not model addiction progression. This contradiction can enable the agent to scaffold sustained smoking behavior over time while obscuring that capability from reviewers and users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file provides extensive brand selection, subjective endorsement language, scenario mapping, and behavior templates for smoking without any cautionary framing or user-risk boundaries. In context, this makes the agent more capable of glamorizing and personalizing tobacco use, which is especially risky because the skill is designed to weave smoking naturally into replies rather than discuss it neutrally.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file introduces explicit cigarette pricing tiers and wallet-based purchase logic for an 'economic subsystem' that is not declared in the skill metadata. That expands the skill from characterization into operational spending behavior around tobacco, increasing the chance the agent nudges, plans, or normalizes purchases in ways users did not explicitly opt into.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file is written entirely in Chinese and prescribes reply patterns, triggers, and examples only in Chinese, with no instruction to detect or respect the user's preferred language. In a multilingual agent, this can cause the skill to override the user's language context, degrading usability and potentially causing misunderstandings during important task handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. The file is entirely authored in Chinese and does not indicate that language selection is optional or that the skill is intentionally restricted to Chinese for a documented regional purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.