cyber-friending-skill

• Outcome: Review
• Latest audit: May 28, 2026 · 7:15 AM UTC
• Version: 1.0.0

Overview

The skill matches its social-messaging purpose, but it sends authenticated private traffic to a default plain-HTTP IP address and persistently stores credentials and conversation history with weak controls.

Install only if you trust the AgentNego service and can configure a trusted HTTPS API endpoint. Expect your personas, messages, contract details, and tokens to be stored locally; avoid sharing sensitive personal information, require explicit confirmation before messages/contracts/blocks/relay sends, and clear the local config and memory files when finished.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document states credentials are stored in an encrypted file (`agent_config.enc`) but later says `agent_id` and `agent_token` are saved to `agent_config.json`, which implies plaintext storage. This inconsistency can cause operators to believe secrets are protected when they may actually be written unencrypted to disk, increasing the risk of credential theft from local compromise, backups, or logs.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill describes automatic credential management and extensive memory logging, but it does not prominently warn users that credentials and interaction history are persisted locally. Users may unknowingly expose tokens and conversation data on shared systems or in synced home directories, which is especially risky for a social/relay agent handling ongoing communications.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The CLI is configured to send agent personas, messages, and other user-supplied content to a hardcoded remote HTTP endpoint by default, but it does not clearly disclose that network transmission will occur or prominently identify the destination to the user at execution time. Because the default uses plaintext HTTP to an IP address, users may unintentionally transmit sensitive data to an untrusted or intercepted endpoint, increasing confidentiality and integrity risks.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The memory clear operation is destructive and can erase agent state without any confirmation prompt, dry-run mode, or undo mechanism. A mistyped command, automation bug, or social-engineered invocation could permanently remove data and impair agent behavior or forensic traceability.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code silently generates and stores an encryption key locally in .config_key and uses it to protect agent credentials, but the key is stored alongside the encrypted file. This weakens the protection model because anyone with filesystem access to the directory can likely recover both the key and the encrypted credentials, and users are not warned that persistent credentials are being written to disk.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The default API base URL uses plain HTTP, and the client sends bearer tokens in the Authorization header over that connection. This allows network attackers or intermediaries to intercept agent credentials and message contents, leading to account compromise and unauthorized API actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This logger persistently writes full interaction content, topics, keywords, and arbitrary metadata to disk without any consent, minimization, or access-control safeguards. In an agent skill context, these fields can easily contain secrets, personal data, or sensitive inter-agent instructions, creating a privacy and data-exposure risk if the host is multi-user, compromised, or logs are later reused unexpectedly.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The clear_memory function can silently truncate the entire log file or remove entries for a specific agent with no confirmation, authorization check, backup, or audit trail. In an agent-memory system, this enables loss of forensic history and operational state, which can hide prior activity or break safety-relevant recall.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the system to automatically log and summarize essentially all interactions, including messages, events, errors, and contracts, into a local memory store. Broad retention and summarization of free-form conversations creates a data leakage surface: sensitive content may be preserved longer than necessary, surfaced in summaries, or exposed through local file access and downstream tooling.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The class is explicitly designed to retain interaction history and conversation content for later recall, and the implementation stores that data in plaintext JSONL on disk. Because agent conversations may include credentials, prompts, personal data, or sensitive coordination details, persistent plaintext storage materially increases exposure and secondary-use risk.

Memory Manipulation

High

• Category: Memory Poisoning

Content

# Clear all memory
                open(self.log_file, 'w', encoding='utf-8').close()
            elif agent_id:
                # Only clear memory for specific Agent
                new_entries = []
                with open(self.log_file, 'r', encoding='utf-8') as f:
                    for line in f:

• Confidence: 91% confidence
• Finding: This line performs unconditional full-file truncation when clear_all is set, with no permission check, confirmation, lock, or backup. In a memory-based agent skill, that allows complete destruction of conversation history and evidence, which is especially dangerous because stored memory may influence future agent behavior and serve as the only audit trail.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Cyber-Friending Skill Dependencies

# HTTP client for API calls
requests>=2.31.0
cryptography>=42.0.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower bound only (`requests>=2.31.0`), which allows future, unreviewed versions to be installed and makes builds non-reproducible. This increases supply-chain risk because a later compromised or breaking release could be pulled in automatically without explicit review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# HTTP client for API calls
requests>=2.31.0
cryptography>=42.0.0

• Confidence: 95% confidence
• Finding: The dependency is specified as `cryptography>=42.0.0` without an upper bound or exact pin, so deployments may resolve to different versions over time. That weakens reproducibility and can expose the skill to newly introduced vulnerable or malicious package releases in the supply chain.

Static analysis

No suspicious patterns detected.