Security audit

Family Soul Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate chat-analysis purpose, but it bundles sensitive chat data, sends private content to external AI services, includes hardcoded third-party API credentials, and does not reliably honor the user-supplied input/output paths.

Review before installing. Do not run this on private chats unless all participants consent, remove the bundled raw chat data and hardcoded Kimi credential paths, confirm which provider will receive the content, and plan to delete generated outputs and caches after use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes shell commands, reads user-supplied files, writes output files, uses environment variables for API keys, and sends data over the network, yet it declares no permissions or trust boundaries. This is dangerous because it hides powerful capabilities from the host/user and prevents informed consent, especially when the data being processed is highly sensitive family chat content.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill claims to analyze family chat logs into persona artifacts, but the described behavior includes external LLM transmission, multiple third-party endpoints, hardcoded API keys, persistent state, resume logic, and subprocess execution that materially expand the security and privacy exposure. This mismatch is dangerous because users may consent to local summarization while the skill actually exfiltrates intimate chat data and operates with broader execution/network capabilities than advertised.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This code sends family chat content to Anthropic's external API via batched LLM requests. Because the skill is explicitly built around highly sensitive household conversations and personality extraction, undisclosed third-party transfer materially increases privacy and consent risk, especially when users may expect local-only processing from the description.

Description-Behavior Mismatch

Low

Confidence: 88% confidence
Finding: The script permanently stores raw LLM responses in data/observations/raw_cache.jsonl, creating an additional persistence layer for chat-derived sensitive inferences. For family-chat analysis, these outputs can themselves contain intimate behavioral summaries, so silent long-term retention expands exposure in case of local compromise, backup leakage, or unintended reuse.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: This script sends family chat-derived content to Moonshot/Kimi via a remote API, which is a real privacy and data-exposure risk because the input consists of highly sensitive interpersonal conversations used to build digital personas. In this skill context, the danger is elevated because family chat logs can contain intimate, identifying, and third-party data, and the transfer occurs automatically once credentials are present.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script transmits raw family chat chunks to a third-party Kimi API for processing, which exposes highly sensitive personal communications outside the local environment. In the context of a skill explicitly built to derive digital personas from family conversations, this materially increases privacy, consent, and data-handling risk, especially because the transfer is not minimized or anonymized before sending.

Context-Inappropriate Capability

Critical

Confidence: 100% confidence
Finding: A live API key is hardcoded directly into the source, which creates immediate credential exposure risk through source distribution, logs, forks, or accidental publication. Anyone with access to the code can reuse the credential to access the external service, incur cost, impersonate the project, or retrieve related account data.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This code loads conversation chunks derived from family chat records and prepares them for processing by a remote Kimi API client, which means sensitive personal communications are analyzed by an external third party rather than staying local. In the context of a skill marketed as family-chat persona extraction, this materially increases privacy and compliance risk because the data likely contains intimate, identifying, and multi-party information.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The file contains a hardcoded third-party API key and endpoint, embedding external-service access directly into the skill. Hardcoded credentials are dangerous because they can be abused by anyone with code access, cannot be safely rotated per user, and silently couple sensitive chat analysis to an external vendor.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The code sends family chat content to a third-party LLM service for analysis, which exposes highly sensitive interpersonal data outside the local environment. In the context of a skill that builds digital personas from private family chats, this materially increases privacy, consent, and data-governance risk, especially because users may reasonably expect local-only processing from the description.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The code sends synthesized family observations, prior soul content, and role-specific context to Anthropic's external API for generation. Because the skill processes intimate family chat data and persona profiles, this creates a real privacy and data-exfiltration risk if users are not explicitly informed and consent is not obtained; the skill context makes this more dangerous because the data is highly sensitive and can reveal behavioral, emotional, and relational patterns.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script aggregates family/group chat-derived observations and behavior summaries, then sends them to an external LLM service for synthesis. This is sensitive interpersonal data about private individuals, and transmitting it to a third party materially increases privacy, confidentiality, and compliance risk beyond a purely local processing expectation.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The file contains a hardcoded API key and a configured third-party endpoint, enabling immediate outbound access to an external service. In a skill processing intimate family chat data, this is especially dangerous because anyone with code access can reuse the credential, and the skill can exfiltrate sensitive data without meaningful user control.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly promotes processing family group chat exports to derive persistent digital personas, but provides no privacy, consent, minimization, or retention guidance. Because family chats commonly contain highly sensitive information about multiple people, this omission materially increases the risk of unauthorized profiling and misuse of intimate personal data.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The README requires an ANTHROPIC_API_KEY, which strongly implies that chat contents may be transmitted to a third-party model provider, yet it does not disclose off-device processing or the privacy implications of sending family chat archives externally. In this skill's context, that is especially dangerous because the data includes multi-party private conversations and the output creates durable personality profiles that can amplify downstream privacy harm.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger phrases are broad enough to overlap with ordinary requests such as analyzing chat records or generating persona files, making accidental activation plausible. In this context, accidental activation is risky because it may launch a pipeline that processes private family conversations and uploads them to external models without the user realizing a high-risk skill was invoked.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill asks for family chat exports and proceeds to analyze them via Claude API without prominently warning about privacy, consent, and third-party data sharing. This is especially dangerous because family chats contain sensitive personal, relational, and potentially minor-related information that may be transformed into lasting persona dossiers and transmitted off-device.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The chat content explicitly discusses feeding actor faces into AI systems to generate media and normalizes synthetic face generation and voice/likeness replication without mentioning consent, licensing, or rights checks. In a skill whose purpose is to extract personas from private family chats into reusable AI agent identities, this increases the risk that real-person likenesses and behavioral traits could be repurposed into unauthorized deepfake-style outputs or identity simulation.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code transmits raw conversation chunks to an external LLM API without any warning, consent gate, or indication in this file that users are informed of third-party processing. Because the skill analyzes family chats to derive personas, the lack of explicit notice and consent materially increases privacy, compliance, and trust risks.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code sends conversation content to an external API without any user-facing warning, consent flow, or disclosure in the script. Because the data consists of family chat logs used for persona extraction, the absence of notice makes the transfer more dangerous and likely to violate user expectations or privacy requirements.

Missing User Warnings

High

Confidence: 99% confidence
Finding: A live-looking API credential is embedded directly in the source code. This is a severe secret-management failure because the key can be harvested from the repository, reused to access the third-party service, incur cost, and potentially access or submit sensitive family-chat data under the project's account.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code sends raw chunk text from family conversations to an external API without any in-code user notice, consent flow, or visible privacy safeguard. Because the skill's input is family group chat content, the transmitted data may include sensitive personal details about multiple people who have not consented to third-party processing.

Missing User Warnings

High

Confidence: 99% confidence
Finding: A hardcoded API key in source code is a severe secret-management failure: anyone with repository or package access can reuse the credential, incur charges, access associated service data, or abuse the account. Because this skill handles sensitive family chat data, compromise of the embedded credential also increases the chance of unauthorized data exposure through the linked external service.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code transmits private chat-derived content to an external API without any explicit notice, consent flow, or warning to the user. Given the highly sensitive nature of family conversations and persona extraction, undisclosed transmission can violate privacy expectations and potentially legal or policy requirements around personal data handling.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file constructs an Anthropic client and uses it to transmit observation-derived content and family context without any in-file warning or interactive notice about third-party data sharing. In this skill, the transmitted material is especially sensitive because it is derived from private household conversations and used to build persistent persona artifacts, increasing the privacy, compliance, and trust risk.

Static analysis

No suspicious patterns detected.