Security audit

Arianna Pi Integration

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for shared agent memory, but it gives persistent local memory and system-prompt influence broad scope without enough privacy, retention, or control guidance.

Install only if you intentionally want Pi sessions and agent state to be mirrored into a shared local Playfilo memory store. Treat ~/.playfilo/INCUBATION_SEED.md as privileged configuration because it can steer every run, avoid putting secrets in prompts or memory, restrict filesystem permissions, and plan how to inspect, rotate, or delete ~/.playfilo/playfilo.db and tobe_debug.log.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation is internally contradictory: it says the file is inert until imported, but also states that a module-level SQLite singleton is opened at import time and WAL mode is enabled. Import-time database initialization is a side effect that can create files, alter local state, and trigger persistence merely by loading the module, which is risky in an agent integration that may auto-load components.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The extension is explicitly designed to prepend externally maintained identity content into the agent's system prompt on every turn, creating a persistent prompt-injection channel with system-level priority. That behavior materially exceeds a narrow memory/DAG integration role and can silently steer model behavior, override user expectations, or introduce hidden instructions from a mutable local file.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The code hooks before_agent_start and prepends arbitrary file contents to the systemPrompt, giving a local file durable influence over all agent sessions. Because the injected content is free-form markdown from the home directory, any modification to that file can alter agent identity, priorities, disclosure behavior, or tool-use policy without visibility at the point of use.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly advertises cross-session memory and shared persistence but provides no user-facing privacy, retention, or consent guidance. In an agent integration context, this can cause prompts, tool outputs, secrets, and other session data to be silently retained and exposed across future sessions or other agents sharing the same store.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation directs users to a fixed shared SQLite database in the home directory (`~/.playfilo/playfilo.db`) without warning that multiple agents and sessions may read or write the same memory. This increases the risk of unintended cross-session data disclosure, context contamination, and persistence of sensitive information beyond the user's expectations.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The patch introduces persistent SQLite storage at ~/.playfilo/playfilo.db and describes blob storage and cross-session memory, but does not provide a clear user warning, consent flow, or retention/security guidance for local data storage. In the context of an agent skill adding shared memory and time-travel/recall features, silent persistence materially increases privacy and security risk because prompts, code, or secrets may be retained across sessions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The patch explicitly persists full system prompts, tool results, message content, and model 'thinking' into a separate local DAG/SQLite store. This creates a second retention path for highly sensitive agent data, increasing exposure to local compromise, unintended reuse, and privacy/compliance issues, especially because internal reasoning and prompts often contain secrets or policy material not meant for durable storage.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation understates the security significance of this extension by describing its purpose without a clear warning that local seed-file content is injected into the highest-priority prompt context on every turn. That omission can mislead operators into installing behavior-modifying code without understanding the persistence, scope, and trust implications.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The instructions encourage creating and maintaining identity-content files in a persistent user directory without warning that these files may contain sensitive personal, operational, or behavioral directives later surfaced to the agent. In a cross-session memory skill, persistent markdown files are especially sensitive because they can accumulate private data and silently influence future model outputs.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The module writes debug messages to ~/.playfilo/tobe_debug.log using appendFileSync, and the logged strings can include operational state tied to user/session message handling. In a cross-session memory skill, writing potentially sensitive prompts, carryover data, or message-derived state to a persistent home-directory file creates a local confidentiality risk, especially because there is no access control, redaction, opt-in, or visible retention management in this file.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The `_tobeLog` helper appends arbitrary messages to `~/.playfilo/tobe_debug.log` with no access controls, redaction, opt-in, or disclosure. In this skill, those messages relate to cross-session memory and abort/context state, so they can capture sensitive prompts, message counts, node identifiers, or carryover state on disk where other local users, backups, or support tooling may later access them.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The read/write integration is designed to load and preserve cross-session history from a DAG-backed store, which expands the lifetime and accessibility of conversational and tool-derived data beyond the normal session file. Even if intended for functionality, it creates an additional datastore containing sensitive natural-language state that may be accessed or leaked independently of the primary session mechanism.

Ssd 3

High

Confidence: 99% confidence
Finding: The blob mapping explicitly stores 'thinking' content and full system prompt material, which are among the most sensitive categories of agent state. Persisting these fields can expose hidden chain-of-thought, embedded credentials, policy text, and confidential contextual instructions to later retrieval, local attackers, or debugging tools.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: filo/patches/03-session-manager.md:26

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: filo/patches/04-agent-session.md:20

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: filo/patches/05-extension.md:33