Syft News Hub

• Outcome: Review
• Latest audit: May 28, 2026 · 11:25 AM UTC
• Version: 1.0.1

Overview

This appears to be a real Syft news helper, but it stores persistent profile files and asks the agent to make confident demographic-style inferences from your follows.

Install only if you are comfortable letting the skill use your authenticated Syft follows/search signals and write reusable local profile, briefing, storyline, and preference files. Review generated profile summaries before reuse, especially any demographic, class, identity, political, personality, or lifestyle inferences, and avoid using those inferences for consequential decisions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The prompt explicitly instructs the model to generate strong sociodemographic inferences and present them as high-confidence editorial observations based only on interest and aversion data. That exceeds the stated news-workflow purpose and creates a real risk of inferring or revealing sensitive traits such as class, ethnicity, age, politics, religion, or mental-state proxies without user consent.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The default prompt tells the agent to 'choose and run the right Syft-only workflow' across several different actions, but it does not define concrete activation boundaries, required user intent, or safety checks before execution. That ambiguity can cause over-broad invocation or unintended workflow selection, especially in a root skill package coordinating multiple subskills and durable editorial/profile operations.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The file imposes a default language choice ('Simplified Chinese unless asked otherwise') without any stated user preference or workspace-level setting. This can override user expectations, reduce transparency, and in some contexts manipulate downstream outputs or accessibility, though it does not by itself create code-execution or data-exfiltration risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs creating or refreshing several files in the workspace without requiring prior user consent or a clear notification that local artifacts will be modified. In an agent setting, silent file writes can surprise users, overwrite existing work, or persist sensitive inferred profile data without adequate awareness.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The skill tells the agent to run local Syft CLI commands (`syft status` and `syft following`) without warning the user that subprocesses will be executed. Even though these commands appear read-oriented, executing local commands without disclosure reduces transparency and may expose local environment details or fail in unexpected ways.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Forcing Simplified Chinese output by default without user opt-in can override user preference and meaningfully alter comprehension, reviewability, and consent around generated artifacts. In security-sensitive or profile-writing workflows, unexpected language switching can make it harder for users to detect mistakes, sensitive inferences, or unwanted file changes.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The prompt mandates Simplified Chinese output regardless of explicit user preference, which can override user language expectations and create accessibility or UX issues. While not as severe as privacy inference, it is still a genuine policy and usability flaw because it forces output behavior without opt-in.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The prompt tells the model to derive high-confidence sociodemographic conclusions from user interests and aversions and to avoid sounding cautious, which amplifies the chance of exposing sensitive personal attributes or stereotyping users. In the context of a profiling workflow, this is especially dangerous because it turns behavioral data into potentially sensitive identity claims that may be inaccurate, invasive, and difficult for the user to contest.

Persistent Context Injection

Medium

• Category: Memory Poisoning

Content

---
name: syft-guidance-rulebook
description: Use when the user wants to capture long-lived preferences, editorial rules, branch preferences, or filtering instructions into a persistent rulebook in Codex or Claude Code without local helper scripts. Also use when the user wants a confirmation-first workflow before saving durable preferences.
---

# Syft Guidance Rulebook

• Confidence: 82% confidence
• Finding: This skill is designed to persist durable user guidance into a rulebook, which creates a persistent context injection surface: incorrect, overbroad, or adversarially phrased instructions could influence future outputs well beyond the current conversation. The confirmation-first workflow makes the risk less dangerous than covert memory writing, but persistent storage of behavioral instructions still carries real integrity and privacy risk if the confirmation step is weak, ambiguous, or bypassed operationally.

Static analysis

No suspicious patterns detected.