Rizz Coach

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:44 PM UTC
• Version: 1.0.0

Overview

This is a coherent AI dating-text coach, but it needs Review because it sends private relationship text to Anthropic without a clear privacy notice and the simulator trusts caller-supplied conversation state.

Review before installing if users may paste real private chats, names, contact details, or sensitive relationship context. The skill should add clear third-party processing and privacy notices, validate simulator state, limit history size, check all generated text fields, and update or pin dependencies before broad use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: src/skill.ts:133

Finding

Caller-Controlled Simulator State Enables Prompt Injection and Safety Bypass

Content

View full analysis

`${t.speaker === "user" ? "User" : persona.name}: ${t.message}`) .join("\n"); return `You are playing a character in a flirting conversation simulator. The user is practicing their texting game. Your character: Name: ${persona.name} Personality: ${persona.archetype} Description: ${persona.description} Warmth level: ${persona.warmthLevel}/3 (1 = reserved/guarded, 2 = moderate, 3 = warm/open) Conversation so far: ${history || "(No messages yet — this is the opening)"} User just sent: "${userMessage}" ``` ### Technical Analysis The routing layer treats `payload.state` as a valid `SimState` through a TypeScript assertion. Type assertions provide no runtime validation, so a caller can supply arbitrary values for: - `state.persona.name` - `state.persona.archetype` - `state.persona.description` - Historical turn messages and speaker values - `state.currentScore` - `state.m ...[truncated 2194 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/modes/conversationSim.ts:134

Finding

LLM-Generated Coaching Tips Bypass Output Safety Validation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The lockfile includes form-data 4.0.5, which is flagged for CRLF injection in multipart field names or filenames. If this skill constructs multipart requests using attacker-controlled names, an attacker could tamper with HTTP multipart boundaries/headers and potentially smuggle or alter request content sent to downstream services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Conversation Simulator explicitly states that session state carries the full conversation history, but the skill description provides no user-facing privacy warning about retention, handling, or visibility of that content. Because users are encouraged to paste intimate texting and flirting exchanges, this omission can lead to oversharing of sensitive personal or relational data without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The CLI solicits free-form user message content and optional context for analysis without warning users not to paste sensitive personal, intimate, or regulated data. In a dating-assistant context, users are especially likely to enter private conversations, increasing the chance of unintended exposure to logs, downstream model providers, or support/debug channels.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This flow asks users to paste 'their message,' which directly encourages submission of third-party communications without any consent or privacy warning. Because the feature is designed around analyzing someone else's message, it raises elevated privacy and confidentiality concerns compared with generic text input.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The simulator accepts an ongoing stream of conversational content with no disclosure about sensitive-data handling, even though users may role-play or paste real chats over multiple turns. Multi-turn interaction increases the volume of potentially sensitive data exposed and can reveal patterns, identities, and relationship details over time.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The function sends the user's conversation content and accumulated chat context to Anthropic via client.messages.create(...) without any evidence in this file of consent, minimization, or a declared need for third-party processing. Because this mode handles free-form interpersonal messages, users may disclose sensitive personal or intimate content, making undisclosed external transmission a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file transmits userMessage and prior turns to an external LLM service but does not include any explicit warning or notice to the user that their messages leave the local skill boundary. In a conversation-simulator context, that omission is especially risky because users may treat the interaction as private practice and reveal personal, romantic, or otherwise sensitive text.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This function sends the user's message and optional context to Anthropic's external API for rewriting. In a text-rewrite skill this transmission is functionally necessary, but without explicit consent, disclosure, or data-handling constraints it still creates a real privacy and data-exposure risk if users provide sensitive content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code forwards user-provided message and context to an external LLM, but this file contains no explicit disclosure, consent flow, or indication that sensitive user text may leave the local system. That makes accidental exfiltration of personal, confidential, or regulated data more likely, especially because 'context' may include more sensitive information than the main message.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code sends user-provided message and optional context to Anthropic's external API for scoring, but nothing in this file indicates consent, disclosure, minimization, or redaction before transmission. Because flirting messages and relationship context can contain sensitive personal data, this creates a real privacy/security issue if users are unaware their content leaves the local system or if secrets/PII are included in context.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The lockfile includes esbuild 0.27.3, which is flagged for a documented advisory affecting the esbuild development server on Windows with arbitrary file read exposure. In this package context it appears only as a devDependency transitively used by tsx, so the issue is real but its exploitability is limited to development workflows that actually run the vulnerable dev server on affected platforms.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The runtime dependency uses a caret version range, which allows newer minor/patch releases to be installed over time. This can introduce supply-chain risk and reduce build reproducibility if an upstream release is compromised or introduces breaking behavior.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

"author": "",
  "license": "ISC",
  "dependencies": {
    "@anthropic-ai/sdk": "^0.39.0"
  },
  "devDependencies": {
    "@types/node": "^25.4.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The development dependency @types/node is not pinned to an exact version, so installs may resolve to different package contents over time. While this is primarily a dev-time package, it still expands the supply-chain attack surface and weakens reproducibility.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json

"@anthropic-ai/sdk": "^0.39.0"
  },
  "devDependencies": {
    "@types/node": "^25.4.0",
    "tsx": "^4.21.0",
    "typescript": "^5.9.3"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The tsx development tool is specified with a caret range, permitting automatic upgrades within the major version. Because it is executed during development, a compromised upstream release could affect local environments or CI pipelines.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json

},
  "devDependencies": {
    "@types/node": "^25.4.0",
    "tsx": "^4.21.0",
    "typescript": "^5.9.3"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The typescript compiler dependency is unpinned, which can lead to non-reproducible builds and exposure to malicious or faulty upstream releases. As a build tool, it may influence compilation behavior in developer or CI environments.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"devDependencies": {
    "@types/node": "^25.4.0",
    "tsx": "^4.21.0",
    "typescript": "^5.9.3"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The prompt requires the model to act as "Rizz Coach" and "speak like a sharp, funny friend," imposing a fixed communication style on all interactions. Under the policy, forcing a specific language or locale style without user choice can be a natural-language policy concern when no opt-in or alternative is offered.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This TypeScript file contains multiple hard-coded user-facing messages and titles in English, such as fallback feedback and grading titles. Because the skill does not indicate any user opt-in or locale selection, it implicitly forces a specific language for output, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.