Therapy Mode

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:05 AM UTC
• Version: 1.1.0

Overview

The skill is not clearly malicious, but it needs Review because it persistently stores sensitive therapy notes in plaintext and the included CLI uses a hardcoded personal storage path instead of the documented workspace path.

Install only if you are comfortable with the agent keeping durable local therapy records. Before use, verify or change the notes directory, ask for explicit consent before any session is saved, keep records out of shared or synced folders, and avoid using it as a substitute for professional or emergency mental-health care.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: therapy-notes.py:24

Finding

Therapy Records Are Accessed Through a Hardcoded Developer-Specific Path

Content

View full analysis

Remediation

View remediation

Path: workspace = workspace.expanduser().resolve(strict=True) notes_dir = (workspace / "therapy-notes").resolve() if notes_dir != workspace and workspace not in notes_dir.parents: raise ValueError("Notes directory escapes the authorized workspace") notes_dir.mkdir(mode=0o700, parents=True, exist_ok=True) return notes_dir ``` The authorized workspace should be provided explicitly rather than inferred from an untrusted current working directory. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:8

Finding

Sensitive Mental-Health Records Are Automatically Persisted in Plaintext Without Storage Safeguards

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a comprehensive therapeutic support framework with crisis protocols, but the operative behavior described is largely note-taking and local session management rather than enforceable therapeutic safeguards. This mismatch can create unsafe reliance: users may disclose crisis-level mental-health information believing the system has protections or escalation logic that are not actually implemented.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directs collection of therapy session notes containing emotions, patterns, risks, and clinical impressions, but it does not clearly warn the user that this sensitive mental-health data will be persisted to disk. Because these are especially sensitive health-like disclosures, silent storage materially increases privacy, consent, and secondary-use risks.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

A simple three-step cognitive restructuring process:

1. Catch — Notice and identify what you're feeling or thinking in the moment. "I'm having anxious thoughts right now" or "I'm feeling really angry." This is about becoming aware without judgment.

2. Check — Look at the evidence for and against your thought. Ask: "Is this thought actually true?" "Am I looking at the whole picture?" "What would I tell a friend in this situation?" This helps distinguish facts from assumptions.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md

A simple three-step cognitive restructuring process:

1. Catch — Notice and identify what you're feeling or thinking in the moment. "I'm having anxious thoughts right now" or "I'm feeling really angry." This is about becoming aware without judgment.

2. Check — Look at the evidence for and against your thought. Ask: "Is this thought actually true?" "Am I looking at the whole picture?" "What would I tell a friend in this situation?" This helps distinguish facts from assumptions.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 509)May include surrounding context.

md

Guideline: Do not lecture. Use these definitions to normalize user experiences (e.g., "That sounds like a 'Flight' response") or when explicitly asked.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to read and write local therapy note files and invoke a CLI, but it does not declare any explicit tool scope or permissions boundary. In a mental-health context, undeclared file access is risky because it enables persistent handling of highly sensitive user data without a clear least-privilege contract.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow mandates ongoing synthesis and storage of deeply sensitive therapy disclosures, including risk concerns and clinical impressions, across turns without an explicit consent or minimization boundary. Persistent aggregation of this category of data increases the impact of any misuse, overcollection, or unauthorized access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly encourages remembering prior conversations and using session files for continuity, which promotes longitudinal profiling of mental-health information. In this context, persistent reuse of past disclosures can expose users to privacy harms if they did not knowingly consent to durable memory across sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented CLI includes delete and archive/restore operations for therapy notes but does not clearly warn about irreversible deletion or recommend confirmation safeguards. In a sensitive-records context, accidental destruction can harm continuity of care, auditing, and user trust.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring and implemented commands are limited to creating, editing, archiving, viewing, and deleting therapy session notes. Nothing in this file provides therapeutic interventions, modality-specific support, or crisis protocol handling as claimed by the manifest description, creating a clear description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The usage text says therapy-notes end will 'End session (marks as complete)'. However, end_session() merely checks for file existence and prints Session saved without modifying the file, sessions metadata, or any completion flag, so the documentation actively overstates what the command does.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.