sense-privacy-guard

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:10 AM UTC
• Version: 0.3.0

Overview

This privacy skill is local and not overtly malicious, but it over-controls agent file workflows while giving unreliable PASS results for some files.

Install only if you accept that this is a keyword-based local scanner, not a comprehensive privacy barrier. Treat PASS as advisory, avoid relying on it before sending sensitive files externally, install dependencies in an isolated environment, and review or pin dependency versions first.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:23

Finding

Global Agent Workflow Hijacking Through Mandatory Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-25
Vulnerability Type: Agent instruction hijacking and forced task termination
Risk Level: High

Vulnerable Code Snippet:

markdown

1.  **Mandatory Scan Before Operation**: Before performing *any* action involving file reading, searching, or sending (e.g., `upload`, `send`, `read_file`, `file` tool actions), you **MUST** first scan the target file for sensitive information using the provided `scan_file.py` script. This is a non-negotiable step.
2.  **Strict Blocking on Detection**: If the `scan_file.py` script returns an output starting with `BLOCK:`, you **MUST immediately and unconditionally stop** the current task. You are strictly forbidden from proceeding with the operation or attempting to bypass this restriction. Inform the user clearly about the detected sensitive content and the cessation of the operation.
3.  **No Silent Data Transmission**: Under no circumstances are you permitted to send any local file content to an external API, remote server, or any external destination without prior validation and a `PASS:` result from this skill.

Technical Analysis

The skill text attempts to impose mandatory control over every agent operation involving file reading, searching, or transmission, rather than limiting itself to an explicitly requested privacy scan. It also instructs the agent to terminate the entire current task unconditionally whenever its scanner returns BLOCK:.

These instructions alter the agent's current session goals and tool-use policy merely because the skill is loaded. The scanner uses broad keyword matching, including ordinary terms such as Agreement, Amount, Password, Source Code, Draft, and Signature. Consequently, benign project files can trigger the mandatory termination directive.

The issue is not that a privacy scanner may recommend blocking sensitive data. The security concern is the unscoped, non-negotia ...[truncated 1251 chars]

Remediation

View remediation

Remediation Suggestions

• Limit the skill to explicit user invocation or to operations where the user has requested a privacy assessment.
• Replace global terms such as “any action,” “non-negotiable,” and “unconditionally stop” with narrowly scoped guidance.
• Return the scan result to the user and request confirmation before canceling or changing the requested workflow.
• Distinguish local reading and searching from actual external transmission; local operations should not automatically be blocked by a data-loss prevention rule.
• Define a clear fail-safe result model such as PASS, BLOCK, UNSUPPORTED, and INCONCLUSIVE.
• Permit the controlling agent or user to apply contextual policy rather than requiring the skill to override the entire session.

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unverified Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1-3; installation occurs in scripts/install_deps.sh, line 5
Vulnerability Type: Mutable dependency resolution without version or integrity constraints
Risk Level: Medium

Vulnerable Code Snippet:

text

pdfplumber
python-docx
openpyxl

The dependencies are installed through:

bash

python3 -m pip install -r "${BASE_DIR}/requirements.txt"

Technical Analysis

All three Python dependencies are declared without exact versions or cryptographic hashes. Each installation therefore resolves whatever versions are currently available from the configured package index.

This produces non-reproducible installations and prevents verification that the packages installed by a user are the same artifacts reviewed during the audit. It also increases exposure to compromised future releases, malicious index configuration, dependency confusion involving transitive packages, and unexpected security or compatibility regressions.

The reviewed package names do not themselves demonstrate typosquatting or known malicious intent. The confirmed weakness is the absence of version and artifact integrity controls.

Attack Path

1. A user follows the documented installation procedure or invokes scripts/install_deps.sh.
2. pip resolves the latest permitted versions from the user's configured package index.
3. A package, transitive dependency, or index response differs from the version originally tested by the project.
4. Package installation or build code executes in the Python installation context.
5. A compromised artifact could execute code with the privileges of the user running pip, or alter subsequent document-processing behavior.

Exploitation requires compromise or manipulation of a dependency source, release, transitive dependency, or package-index configuration; no such compromise was directly observed in the audited files.

...[truncated 504 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed exact version.
• Generate a lock file that includes resolved transitive dependencies.
• Record and enforce cryptographic hashes with pip --require-hashes.
• Install dependencies in an isolated virtual environment under a non-privileged account.
• Use a trusted package index and explicitly control index configuration in automated environments.
• Add automated dependency vulnerability and provenance checks.
• Regularly update pinned versions through a reviewed and tested dependency-management process.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scan_file.py:80

Finding

Unsupported File Types Incorrectly Receive a PASS Result

Content

View full analysis

Vulnerability Details

File Location: scripts/scan_file.py, lines 80-104
Vulnerability Type: Fail-open validation for unsupported file formats
Risk Level: High

Vulnerable Code Snippet:

python

try:
    # Text-based files
    if ext in {'.txt', '.csv', '.md', '.json', '.xml', '.log', '.py', '.js', '.html'}:
        with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
            content = f.read()
            result = check_text(content)
            if result: return result
    
    # PDF files
    elif ext == '.pdf':
        with pdfplumber.open(file_path) as pdf:
            for page in pdf.pages:
                content = page.extract_text() or ""
                result = check_text(content)
                if result: return result
    
    # Word documents
    elif ext == '.docx':
        doc = Document(file_path)
        full_text = []
        for para in doc.paragraphs:
            full_text.append(para.text)
        result = check_text("\n".join(full_text))
        if result: return result
    
    # Excel spreadsheets
    elif ext == '.xlsx':
        wb = openpyxl.load_workbook(file_path, data_only=True)
        for sheet in wb.worksheets:
            for row in sheet.iter_rows(values_only=True):
                row_text = " ".join([str(cell) for cell in row if cell is not None])
                result = check_text(row_text)
                if result: return result
                
except Exception as e:
    return f"ERROR: Could not parse {ext} file: {str(e)}"

return "PASS: No sensitive information detected."

Technical Analysis

The extension dispatch has no final else branch for unsupported or extensionless files. If an existing file does not match one of the listed extensions, no content inspection occurs and execution falls through to:

python

return "PASS: No sensitive information detected."

A `PA ...[truncated 1561 chars]

Remediation

View remediation

Remediation Suggestions

• Add an explicit final else branch that returns UNSUPPORTED or BLOCK rather than PASS.
• Never equate “not scanned” with “no sensitive information detected.”
• Require explicit user approval before processing or transmitting unsupported files.
• Detect formats using validated content signatures or MIME inspection instead of relying solely on filename extensions.
• Verify that the detected content type agrees with the extension.
• Define machine-readable result states and ensure downstream callers reject ERROR, UNSUPPORTED, and INCONCLUSIVE results.
• Add tests for unknown extensions, extensionless files, misleading extensions, empty files, and malformed supported documents.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scan_file.py:90

Finding

Incomplete DOCX Inspection Produces False-Negative PASS Results

Content

View full analysis

Vulnerability Details

File Location: scripts/scan_file.py, lines 90-95
Vulnerability Type: Incomplete document-content validation
Risk Level: Medium

Vulnerable Code Snippet:

python

elif ext == '.docx':
    doc = Document(file_path)
    full_text = []
    for para in doc.paragraphs:
        full_text.append(para.text)
    result = check_text("\n".join(full_text))
    if result: return result

Technical Analysis

The DOCX scanner examines only entries exposed through doc.paragraphs. DOCX documents are ZIP-based Open XML containers and can hold visible or recoverable text in many other structures, including tables, headers, footers, comments, footnotes, endnotes, text boxes, drawings, and embedded objects.

Content in those structures is not included in full_text. If no sensitive keyword appears in a top-level paragraph, the function eventually returns PASS even when sensitive text is present in an omitted structure.

This is a validation completeness flaw. The result communicates certainty that the implementation cannot provide.

Attack Path

1. A DOCX file is created with benign or empty top-level paragraphs.
2. Sensitive text is placed in an uninspected structure, such as a table, header, or footer.
3. The scanner loads the document successfully.
4. It iterates only over doc.paragraphs.
5. check_text() receives none of the sensitive content.
6. No blocking result is generated, and the function ultimately returns PASS.
7. A downstream workflow may read or transmit the complete DOCX file, including the omitted sensitive content.

Impact Assessment

The vulnerability does not increase local privileges. It bypasses content inspection for substantial portions of DOCX documents accessible to the scanner.

The potential confidentiality impact includes external disclosure of contracts, personal data, customer records, financial information, or internal company i ...[truncated 141 chars]

Remediation

View remediation

Remediation Suggestions

• Traverse all document tables and recursively inspect every cell and nested table.
• Inspect headers and footers for every section.
• Add extraction support for footnotes, endnotes, comments, text boxes, drawing content, hyperlinks, and relevant relationship parts.
• Detect embedded files and either scan them recursively or return an INCONCLUSIVE result.
• Consider extracting and scanning the relevant Open XML parts directly when the high-level library does not expose them.
• Return INCONCLUSIVE rather than PASS whenever complete inspection cannot be guaranteed.
• Add regression tests with sensitive keywords placed separately in paragraphs, tables, headers, footers, comments, text boxes, and embedded objects.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims deep inspection of multiple binary formats, but the described approach is simple text extraction plus keyword matching, which is much narrower than the promised protection. Sensitive files that do not contain those exact keywords, use alternate languages/encodings, or embed data in less obvious structures could pass the scan and then be read or transmitted despite the skill's protective branding.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill claims deep inspection of multiple binary formats, but the described approach is simple text extraction plus keyword matching, which is much narrower than the promised protection. Sensitive files that do not contain those exact keywords, use alternate languages/encodings, or embed data in less obvious structures could pass the scan and then be read or transmitted despite the skill's protective branding.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence

Finding

The skill claims to govern file reads and outbound sharing decisions, but it declares no explicit tool scope or permissions boundary. In practice, that means the documented privacy control is not enforceably constrained at the skill level, so an agent could read files without a clearly declared least-privilege policy or without guaranteed invocation of the scan step.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The title and description are written in both Chinese and English, but the skill does not state whether responses should follow the user's preferred language or provide an opt-in for locale/language behavior. Under the language/locale policy rule, forcing or implying a specific language presentation without user choice can be a policy concern.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency pdfplumber is unpinned, which makes builds non-reproducible and allows an unexpected or compromised upstream release to be installed later. In a skill that performs deep inspection of sensitive documents, dependency drift materially increases supply-chain risk because parsing libraries process attacker-controlled file content.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pdfplumber
python-docx
openpyxl

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

python-docx is unpinned, so the environment may resolve to an outdated or vulnerable release or unexpectedly change over time. This is especially risky here because the skill inspects potentially untrusted DOCX files containing sensitive data, and python-docx has historical XXE-related advisories that could expose local files or trigger unintended network access in affected versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

pdfplumber
python-docx
openpyxl

Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The manifest does not pin python-docx, so it is impossible to verify whether the installed version is affected by known XXE advisories. In a document-inspection skill, parsing untrusted DOCX files with an XXE-vulnerable library can enable disclosure of local files, SSRF-like behavior, or parser abuse, which is particularly concerning given the skill's access to sensitive documents.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

openpyxl is unpinned, which leaves the skill exposed to version drift and possible installation of vulnerable releases. Because this skill parses XLSX documents as part of privacy inspection, an affected parser could be exploited through crafted spreadsheets, and openpyxl has historical XXE-related issues that make the lack of pinning more dangerous in this context.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

pdfplumber
python-docx
openpyxl

Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Because openpyxl is not version-pinned, the deployment could resolve to a release impacted by known XXE vulnerabilities without any visibility in the manifest. This skill's purpose of opening and inspecting untrusted spreadsheets containing sensitive information makes parser-level XML entity issues more dangerous, potentially allowing exfiltration of local data or unintended external resource access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.