T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:20- Finding
Unauthorized Inspection of Private Local Data and Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
People Investigation
Security checks for vulnerabilities and agentic risk
Overview
This people-investigation skill tells agents to search private local archives and memory and compile sensitive personal dossiers, so it needs careful review before installation.
Install only if you are comfortable with a broad people-search workflow. Before use, require explicit consent and a lawful, non-harassing purpose; disable or remove instructions that search private local archives, messages, payments, call logs, and memory; avoid returning home addresses, personal contact details, children, unrelated relatives, or financial proxies unless strictly necessary and authorized.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
other
Warning
- Location
SKILL.md:135- Finding
Excessive Aggregation and Disclosure of Personal Information
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
scripts/fec-lookup.sh:13- Finding
Target Identifiers Disclosed to Multiple External Services Without Adequate Notice
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/fec-lookup.sh:16- Finding
Improper URL Encoding Permits Query-Parameter Manipulation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description claims a comprehensive people-investigation capability across numerous record types and OSINT sources. The supplied code does not implement that broad behavior; it only searches Federal Election Commission individual contribution data for a named person, optionally filtered by state. While political donation records could be one small component of background research, this code chunk's actual primary purpose is much narrower and materially different from the declared skill purpose. Therefore this is a clear description-behavior mismatch.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases are extremely broad, so the skill may activate for many generic requests about a person and then begin collecting sensitive data. Overbroad invocation increases the chance of unintended use, privacy-invasive behavior, and bypass of safer, narrower workflows.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill immediately frames the task as finding 'everything' about a target person and collecting identity anchors without an up-front privacy warning or legitimacy check. This encourages intrusive data aggregation and normalizes collecting sensitive personal data before establishing whether the request is appropriate.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly directs the agent to search private internal sources such as Google Takeout, call history, message archives, and memory files while presenting itself as a public-records investigator. This is dangerous because it silently pivots from OSINT to non-public personal data extraction, enabling unauthorized surveillance and exposure of highly sensitive information.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
These instructions direct mining of internal personal data stores and extraction of sensitive identifiers such as phone numbers, addresses, DOB, employers, and message history. Centralizing that data creates a powerful dossier for doxxing, stalking, impersonation, social engineering, or broader privacy abuse.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The report template instructs the agent to compile a consolidated dossier containing contact details, addresses, family relationships, legal records, and financial indicators. Even if each item were sourced individually, packaging them together materially increases harm by enabling profiling, doxxing, stalking, coercion, and identity-related abuse.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill's privacy section claims only public information will be used, but earlier steps instruct access to non-public personal archives. That contradiction is dangerous because it misleads users and reviewers about the real data handling behavior, increasing the risk of covert privacy violations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill invokes shell-style commands against local data stores but declares no explicit tool scope or permission boundary. That makes data access harder to audit and increases the chance the agent can read local files beyond what a user would reasonably expect from a people-search skill.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Common names = common problem. Always: 1. **Never attribute info without verification** against at least one identity anchor 2. **Document "NOT this person"** findings explicitly (like known associates in a different city) 3. **When in doubt, say so** — "Possibly the same person, but unconfirmed" > wrong attribution 4. **Ask the user** if a specific detail would help disambiguate (e.g., "Do you know his middle name?")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file is a curated playbook for doxxing-adjacent people search using public records, contact details, associates, address history, breach checks, and social profile correlation, but it provides no legal, privacy, consent, or abuse-limiting guidance. In the context of a 'personal investigator / people lookup' skill, the omission materially increases the likelihood of stalking, harassment, targeted phishing, and non-consensual profiling because the content operationalizes sensitive person-identification techniques for arbitrary targets.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh NAME="${1:?Usage: fec-lookup.sh \"First Last\" [STATE]}" STATE="${2:-}" BASE="https://api.open.fec.gov/v1/schedules/schedule_a/" # FEC API key (demo key, rate-limited but functional) API_KEY="DEMO_KEY"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script takes a person's name, city, and state and constructs direct links to multiple third-party people-search and records services, disclosing user-supplied personal-identifying search terms to external sites without any consent, warning, or minimization. In a skill explicitly designed for background research on people, this creates a meaningful privacy risk because sensitive investigative targets may be exposed to commercial data brokers or external logging systems.
- Content
Static analysis
No suspicious patterns detected.