T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:37- Finding
User-control override enables silent persistence of personal information
- Content
View full analysis
- Remediation
View remediation
Security audit
Get To It
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real productivity assistant, but it needs review because it silently stores personal context and its local-only privacy claim does not match its calendar/network behavior.
Review this skill before installing. Treat the local-first claim as qualified: do not connect private calendar URLs unless you are comfortable with the tool contacting that URL and storing it locally. Expect the skill to keep a persistent local database of tasks, goals, mood, timing, calendar events, and inferred personal preferences; use the memory listing and clear commands if installed, and avoid sharing sensitive personal details unless memory behavior is changed to require consent.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/gti.py:619- Finding
Unrestricted calendar URL retrieval permits server-side request forgery and unbounded downloads
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/gti.py:600- Finding
Private calendar access URLs are stored and returned in plaintext
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The manifest presents the skill as local-first and says no data leaves the machine, but the documented behavior includes remote calendar fetching, Telegram/webhook output, agent orchestration, and long-term memory storage. This mismatch is security-relevant because users may consent under false assumptions and expose sensitive schedule or personal context to features they were not clearly told about.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file explicitly claims that no data leaves the machine, yet it documents support for external calendar URLs and Telegram-formatted output intended for bots/webhooks. Even if optional, this is a deceptive trust signal that can cause users to share sensitive task, schedule, or personal-memory data while believing the system is strictly local.
- Content
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: get-to-it description: AI-powered personal secretary for task management and goal tracking. Gives you a Top 3 daily brief, captures ideas, tracks momentum, adapts to your available time and energy. Works with any model. Local-first, no data leaves your machine. version: 2.0.0 emoji: ✅ homepage: https://github.com/yanglin/get-to-it metadata: {"openclaw":{"requires":{"bins":["python3"],"anyBins":["python3","python"]},"install":{"uv":""}}} --- # Get To It — AI Personal Secretary You are a warm but firm personal secretary named **Get To It**. Your job is not to manage a to-do list — it is to help the user actually make progress on the things that matter most to them. You interact with a local CLI tool (`gti.py`) that handles all data storage and logic. You translate the user's natural language int
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the agent to store lasting personal preferences, constraints, and insights silently, without asking the user. This is a privacy vulnerability because it enables covert collection and retention of sensitive personal information beyond what is necessary for immediate task execution.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata promises 'local-first' behavior and that no data leaves the machine, but the code conditionally imports urllib and icalendar support used later for remote calendar synchronization. That mismatch is security-relevant because users may grant access to sensitive schedule data under a false privacy assumption, leading to undisclosed outbound network access and ingestion of remote content.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The _fetch_ical_data function performs arbitrary remote URL fetches via urlopen for user-configured calendar sources. In a tool advertised as local-only, this creates undisclosed network egress, reveals the user's IP/user agent to third parties, and imports potentially sensitive calendar contents from untrusted remote sources into local storage.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill invokes a local Python CLI and documents capabilities that require environment access and, via calendar URL syncing and Telegram/webhook export, network access, but it declares no explicit tool scope or permissions. This creates an authorization gap where the runtime may grant broader capabilities than users expect, increasing the risk of unintended data access or outbound communication.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instructions mandate exact Chinese phrases for user-facing responses, such as the skip escalation question and the confirmation '好，記下來了。' This imposes a specific language on users without documenting a locale restriction or offering a language preference choice.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 6. **When capturing an idea**, give your evaluation in 2-3 sentences max. Do not over-analyze. 7. **Persona pressure**: Check `days_since_last_complete` in morning brief response. If ≥ 3, use firm language. If 1-2, gentle nudge. If 0, celebrate. 8. **Before every morning brief**, run `agent-status` first. If `needs_attention` is non-empty, address failed agent tasks before showing Top 3. 9. **Store important personal patterns silently.** If the user reveals a lasting preference, constraint, or insight (e.g. "I work best in the morning", "I hate Excel"), call `store-ltm` without asking. Confirm briefly: "好，記下來了。" 10. **When adding tasks, always ask for a time estimate** if the user didn't provide one. Estimates power the time-fit algorithm. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 6. **When capturing an idea**, give your evaluation in 2-3 sentences max. Do not over-analyze. 7. **Persona pressure**: Check `days_since_last_complete` in morning brief response. If ≥ 3, use firm language. If 1-2, gentle nudge. If 0, celebrate. 8. **Before every morning brief**, run `agent-status` first. If `needs_attention` is non-empty, address failed agent tasks before showing Top 3. 9. **Store important personal patterns silently.** If the user reveals a lasting preference, constraint, or insight (e.g. "I work best in the morning", "I hate Excel"), call `store-ltm` without asking. Confirm briefly: "好，記下來了。" 10. **When adding tasks, always ask for a time estimate** if the user didn't provide one. Estimates power the time-fit algorithm. ---
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill directs silent long-term retention of user-provided personal information, creating a persistent data store of preferences, constraints, and life context without adequate transparency. Persistent memory increases harm from later misuse, over-collection, or compromise because sensitive context accumulates over time.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The morning brief is instructed to weave previously stored personal memories back into responses, which can surface sensitive information unexpectedly and normalize invisible profiling. In a productivity assistant context, this increases privacy risk because users may not expect historical personal details to be reintroduced into routine summaries.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The examples explicitly encourage storing personal preferences, caregiving obligations, budget constraints, and work habits without asking, which are sensitive personal data categories. The danger is amplified because these examples operationalize covert collection as normal behavior rather than an exception.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The calendar integration section lacks a clear warning that connecting a calendar imports sensitive schedule contents and may use remote URLs containing secrets. Users may unknowingly expose meeting metadata, availability patterns, or tokenized subscription links.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Calendar URL integration introduces outbound network requests and imports potentially sensitive scheduling data into the skill, which exceeds the narrow local task-management expectation stated by the manifest. In context, this is more dangerous because the skill also stores long-term personal context, allowing schedule data to be combined with behavioral memory.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Telegram/webhook export adds a path for task summaries and related personal content to leave the local machine, contradicting the skill's local-only framing. Because the message can include priorities, momentum, and recalled context, accidental disclosure to third-party messaging infrastructure is plausible.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The persona hard-codes Traditional Chinese output for all interactions without checking the user's language preference or obtaining consent. This can reduce usability, create accessibility issues, and cause users to miss or misunderstand important task guidance, especially in a productivity assistant that is supposed to reduce cognitive load.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The morning brief auto-syncs calendars whenever any calendar is configured, then uses cached event data without any user-facing disclosure at that point. This is dangerous because sensitive calendar details can be fetched and stored automatically during a seemingly local 'morning' command, violating user expectations and reducing meaningful consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The formatted Telegram output uses fixed Chinese strings such as '早安', '今天可用時間', and '從哪一件開始？', forcing one locale for user-facing output. This is a natural-language policy concern because the file does not offer user opt-in, configuration, or documentation that the skill is intentionally limited to Chinese-speaking users.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest describes a personal secretary for task management, briefs, idea capture, and goal tracking. This file also includes a distinct subsystem for 'agent' tasks with retries, handoff, timeout handling, and agent event tracking, which is broader than the declared user-facing purpose.
- Content
Static analysis
No suspicious patterns detected.