other
Error
- Location
investigate.py:68- Finding
Fabricated investigation data produces unsupported approval decisions
- Content
View full analysis
- Remediation
View remediation
Security audit
SZZG007 Background Investigation
Security checks for vulnerabilities and agentic risk
Overview
This skill needs review because it profiles people and can generate saved, authoritative-looking risk reports from simulated data without meaningful privacy controls.
Install only if you are prepared to treat this as a prototype or demonstration, not a reliable background-checking system. Do not use its trust scores, verification status, or approval recommendations for real decisions about people unless the skill is redesigned to use authorized sources, source provenance, explicit consent or lawful basis, human review, data minimization, protected storage, and clear retention/deletion rules.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
investigate.py:72- Finding
Declared anonymization and privacy controls are not enforced
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
investigate.py:157- Finding
Caller-controlled output path allows arbitrary writable-file overwrite
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill prominently promotes social media profiling, network mapping, risk assessment, and trust scoring of individuals, but it does not clearly warn users that these are privacy-sensitive activities with significant ethical and legal implications. In this context, the absence of strong warnings and constraints makes misuse more likely, including invasive profiling, reputational harm, and potentially discriminatory decision-making based on inferred traits or associations.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is explicitly framed as a tool for comprehensive background investigation and profiling of customers, bloggers, and other individuals, without any stated consent, purpose limitation, or legal/policy boundary. That makes the context more dangerous, not less, because the primary use case is broad surveillance-style profiling of people, which can enable privacy abuse, discrimination, harassment, or improper eligibility decisions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly promotes comprehensive profiling and background investigations of individuals, including social media profiling, network mapping, trust scoring, and historical activity analysis, but provides only generic ethical language rather than concrete privacy safeguards, lawful-use constraints, consent requirements, retention limits, or anti-abuse controls. In this context, the documentation normalizes sensitive person-level intelligence gathering and risk scoring, which can enable privacy violations, discriminatory decision-making, or misuse for surveillance and doxxing if adopted as-is.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill advertises investigative and profiling functions but does not declare any explicit tool scope or permissions boundaries, while static analysis detected file_write capability. Undeclared write capability increases the risk that an agent could persist collected personal data, generate dossiers locally, or write sensitive outputs without user awareness or policy enforcement.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The usage guidance says to use the skill whenever someone needs to investigate a customer, blogger, or other individual to understand background, credibility, influence, and risks, which is an overly broad invocation trigger. This invites routine profiling of individuals in many contexts without clear necessity, consent, proportionality, or eligibility checks, increasing the chance of privacy abuse and unfair targeting.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The summary explicitly promotes comprehensive background investigation, profiling, and social-media data gathering about individuals, but it does not give any user-facing warning about privacy, reputational harm, consent, legal limits, or data-retention risks. In this context, the omission matters because the skill is designed to assess people rather than systems, increasing the likelihood of misuse for surveillance, unfair scoring, or invasive profiling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The planned expansion to real data sources and automated monitoring increases the skill from one-time profiling into potential continuous surveillance, yet the summary presents this as a routine enhancement without warning users about privacy, consent, legality, or abuse potential. That is dangerous because automated monitoring can silently scale collection and inference about individuals, amplifying harm from misidentification, biased assessments, and unlawful tracking.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The function claims to gather social media data and implies API-backed investigation, but it returns fabricated hardcoded values. In a background-investigation tool, this is dangerous because operators may rely on false evidence and make trust, access, or reputational decisions about real people using invented profile and activity data.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The tool advertises comprehensive background investigation but only fills a template with simulated analysis, fabricated trust scoring, and heuristic red flags. In this skill context, that is especially dangerous because it operationalizes profiling of individuals and can produce authoritative-looking but false risk assessments that may influence business, moderation, or access decisions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code writes a background-investigation report containing personal profiling fields to disk with no privacy warning, retention control, minimization, or access protections. Even though this sample mostly uses placeholder data, the skill is designed for real people and normalizes storage of sensitive profiling output in plaintext JSON, which can expose subjects if the host system is shared or compromised.
- Content
Static analysis
No suspicious patterns detected.