Security audit

account-manager

Security checks for vulnerabilities and agentic risk

Overview

This skill openly manages banned-account switching, but it has broad authority over accounts, contacts, cookies, device login, notifications, and memory migration without enough user-control safeguards.

Review this skill carefully before installing. Only use it in an environment where you are authorized to manage the affected accounts, contacts, devices, cookies, and memories. Require manual approval before account switching, contact export, notifications, cron/config changes, or memory migration, and confirm the workflow complies with platform rules and privacy obligations.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow explicitly includes exporting friend lists, classifying contacts, sending notifications, and migrating account-related data, but provides no consent, approval, or privacy warning step. This creates a real risk of unauthorized processing of personal data, mistaken notifications, and privacy harm during account switching, especially when automation is triggered by ban/risk events.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The example normalizes switching from a banned account to a new account while inheriting friend data, tags, and chat memory, but provides no warning, consent flow, or privacy boundary for transferring user-related data. In the context of account evasion and cross-account migration on platforms like WeChat, this can facilitate bypassing platform enforcement and unauthorized reuse of personal/contact data across identities.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The example presents automatic detection of account bans and autonomous switching to a backup account as routine behavior, without human approval, user notification, or policy checks. In this skill's context, that increases the risk of automated evasion of platform restrictions and unreviewed actions affecting accounts, contacts, and associated data.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The test cases and trigger phrases describe broad, automation-friendly account-switch actions such as '封号后自动切换' and concurrent handling across multiple platforms without clear authorization, confirmation, or scope boundaries. In a skill designed for account/device orchestration, such ambiguous activation patterns can cause unintended or unauthorized account takeover-like behavior, especially if other components consume these examples as operative triggers rather than inert reference data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script processes and emits sensitive personal/contact data including friend nicknames, friend IDs, report/blacklist status, account identifiers, and phone numbers, then prints them in structured JSON or alert messages without any minimization, masking, consent check, or access-control boundary. In this skill context, the purpose is operational account switching and mass contact migration around bans, which makes the exposure more dangerous because it centralizes relationship graphs and risk labels that could be misused for privacy violations, targeting, or internal abuse.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill instructs the system to export/import friend profiles and carry forward `MEMORY.md` during account switching, which can propagate sensitive relationship data and user-related memory into a different account context. That creates a substantial data-retention and cross-account leakage risk, particularly if the new account belongs to a different operator, is compromised, or should not inherit prior conversational context.

Static analysis

No suspicious patterns detected.