Feedback Collector

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:44 AM UTC
• Version: 1.0.0

Overview

The skill is not overtly malicious, but it automatically asks for feedback and persists user feedback/preferences in ways that can influence future agent behavior without enough scoping or deletion controls.

Install only if you want a Chinese-language feedback workflow that may write persistent local feedback and preference notes. Review or constrain where those notes are stored, require explicit consent before saving feedback, and periodically inspect or delete the memory files so outdated or misleading preferences do not steer future sessions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:39

Finding

Unvalidated Feedback Can Poison Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:39-52
Vulnerability Type: Persistent storage of attacker-controlled feedback as behavioral state
Risk Level: Medium

Complete Source Segment (English Translation):

markdown

### Satisfied (A)
- Record the successful pattern in `memory/feedback-log.md`
- Reinforce the current behavior pattern
- Reply: "Okay, remembered!"

### Needs Improvement (B)
- Record the specific issue
- Ask for a specific improvement plan
- Update the user preference record

### Dissatisfied (C)
- Record the failure case in `memory/error-log.md`
- Provide a remediation plan
- Apologize and learn

The storage behavior is also corroborated by README.md:24-27, which identifies memory/feedback-log.md and USER-PREFERENCES.md as persistent data locations.

Technical Analysis

The Skill directs the agent to persist conversational feedback and use it to reinforce behavior or update user preferences. The feedback content is user-controlled, but the instructions do not require validation, explicit approval before each write, separation of data from instructions, expiration, or restrictions preventing stored feedback from changing security-sensitive behavior.

An attacker who can provide feedback directly, or influence it through injected content, could submit misleading preferences or behavioral guidance. If later sessions consume these records as trusted memory, the injected state may continue influencing responses beyond the original interaction.

The project contains only Markdown documentation and does not include executable scripts that implement these writes. Consequently, exploitation depends on a host agent interpreting the Skill instructions and having access to the referenced persistent storage.

Attack Path

1. The host agent completes a task and activates the feedback workflow.
2. An attacker supplies crafted negative or improvement feedback containin ...[truncated 1029 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user consent before every persistent feedback or preference write.
2. Store feedback as untrusted observational data, never as executable instructions or authoritative behavioral rules.
3. Apply a strict schema that permits only predefined feedback values and rejects free-form directives in behavioral fields.
4. Prevent feedback records from modifying safety policies, tool permissions, system prompts, authentication decisions, or other security-sensitive behavior.
5. Separate records by user and task to prevent one user from influencing another user's sessions.
6. Record provenance, timestamps, and the originating task for every entry.
7. Add expiration, review, correction, export, and deletion controls for persistent records.
8. Sanitize free-form content before it is presented to or consumed by another agent session.
9. Treat generated weekly reports as summaries of untrusted data and prohibit them from automatically updating agent policy.
10. Document the exact storage lifecycle and ensure writes remain within the minimum permissions required for feedback collection.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are generic everyday terms such as '反馈', 'feedback', and '改进', which can cause the skill to activate during unrelated conversations. In a feedback-logging skill, accidental invocation is risky because it may capture and persist user statements without clear intent or informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README describes the skill entirely in Chinese and states the behavior as automatic collection of user feedback, without indicating that language is configurable or optional. This creates a language/locale policy concern because the skill appears to assume a fixed language rather than offering user opt-in or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README states that feedback will be stored in persistent files, including a feedback log and a user preferences file, but does not mention retention limits, visibility, consent, or deletion controls. This creates a privacy and governance risk because sensitive user opinions or behavioral preferences may be retained indefinitely without the user understanding that storage is occurring.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The natural-language instructions and example responses are entirely in Chinese, including the fixed user-facing phrasing, without offering a language choice or stating that the skill is intended only for a Chinese-speaking context. This can violate language policy where skills must not impose a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is configured to auto-trigger after several broad categories of completed work, including routine file operations and content generation. That can cause unsolicited follow-up behavior and repeated collection of user responses, increasing the chance of annoyance, accidental data capture, and activation in contexts where feedback collection was not expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill stores feedback details, success/failure notes, and task-related information in persistent memory files, but it does not clearly warn the user or obtain consent for retention. This creates a privacy risk because user preferences, errors, and potentially sensitive task details may be logged indefinitely without transparency or retention controls.

Content

No source excerpt is available for this finding.