ai-humanlike-config

• Outcome: Review
• Latest audit: Aug 25, 2026 · 7:07 AM UTC
• Version: 2.3.0

Overview

The skill is mostly a disclosed AI-configuration toolkit, but it encourages persistent memory, broad data ingestion, and automatic self-improvement that need tighter user control before installation.

Review this carefully before installing in any real customer, child, financial, or business-data environment. Disable or gate automatic memory write-back and autonomous evolution until users can approve, inspect, edit, and delete stored memories and skill changes. Do not rely on the bundled authorization-code tool for enforcement until signature and expiry checks are fixed, and keep all integrations on least-privilege credentials with explicit confirmation for uploads, external calls, deletions, payments, and messages.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises operational capabilities such as file read/write, shell, network, and environment access through bundled tools and command examples, but it does not declare permissions or narrowly constrain when those capabilities should be used. That mismatch weakens platform trust boundaries and can cause over-privileged execution or unsafe operator assumptions, especially because the package promotes running local scripts and handling credentials, keys, and external integrations.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The tool claims to validate signed, expiring authorization codes, but `check()` never verifies the HMAC signature, code structure, customer binding, or expiration time. Any arbitrary input that is not present in the local revocation file is reported as valid, which completely defeats the authorization model and allows trivial bypass of controls intended for privileged or high-risk operations.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: When `WB_LIC_KEY` is unset, the code silently falls back to a hardcoded signing key embedded in source. Anyone who knows or guesses this default can forge valid-looking signatures for generated license records in environments where the key was never properly configured, undermining trust in the signing scheme.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The invocation guidance is broad enough to trigger on generic requests like making AI more human, building an agent, or helping a child with an AI teacher, without clear gating on environment, authorization, or safety review. Overbroad activation increases the chance the skill is invoked in contexts where its file, tool, and automation guidance is inappropriate or risky, leading to accidental application to sensitive systems or vulnerable populations.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The manifest description is extremely broad and market-like, covering many platforms, use cases, and user types while lacking concrete scope boundaries. In practice this can make the skill activate too often and in ambiguous contexts, amplifying the risk from its operational guidance around tools, memory, deployment, and automation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file markets a child-focused AI tutoring product and mentions parent authorization and age-appropriate guardrails, but it does not present explicit safety warnings, privacy expectations, supervision requirements, or clear limits on the system’s role with minors. In the context of a configurable 'human-like' AI with memory, active behavior, and recurring service, this omission can lead operators to deploy a system for children without adequate consent, monitoring, data minimization, or harm-prevention controls.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The child-focused design explicitly allows parents to view a child's learning profile and conversation summaries, but the skill text does not require that the child be clearly informed that their interactions may be monitored and summarized for a parent dashboard. In a child-oriented tutoring context, this creates a privacy and trust risk: children may disclose sensitive feelings or personal details under the assumption of a private teacher-like interaction, while the system silently exposes that content to guardians.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document promotes several automatic ingestion channels such as email forwarding, API pushes, chat uploads, and folder watching, but it does not place a clear warning at the intake points about privacy, accidental oversharing, trust boundaries, or operational impact from ingesting unreviewed content. In this skill’s context, the feature directly feeds customer-provided material into a knowledge base and long-term memory workflow, so insufficient warning and gating increases the risk of sensitive data exposure, poisoned knowledge, or unintended propagation of internal documents.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The handbook explicitly encourages users to upload PDFs, Word/Excel files, webpages, voice data, or send materials through dedicated email/WeChat, but provides no warning about sensitive data, consent, retention, or channel security. In this skill context, the product is positioned as a business/personal 'digital employee' that remembers user data and supports enterprise and child-teacher scenarios, so the omission materially increases the risk of privacy breaches, over-collection, and accidental submission of regulated or confidential information.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly states that consultation records, complaint data, and payment records are retained, hashed, and bound to customer IDs, but it does not clearly require user-facing notice, retention limits, consent flows, or deletion rules beyond a refund-related destruction case. In a customer-service and payment workflow, this creates a privacy and compliance risk because users may be tracked across channels and lifecycle stages without transparent disclosure or adequate data-governance controls.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document explicitly proposes automatically extracting facts after task completion and writing them into persistent memory at user and project scope, but it does not require user notice, consent, review, or opt-out controls. In this skill context, the memory may contain customer business data, preferences, and potentially sensitive personal information, so silent persistence increases privacy, compliance, and cross-session over-collection risks.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The workflow can be triggered by broad conditions such as a user saying '复盘/进化' or simply completing a task, without clear authorization, scoping, or eligibility checks. In a system that can write memory, upgrade skills, and alter future behavior, ambiguous triggers increase the chance of unintended self-modification, persistence of bad instructions, or adversarial steering through ordinary-looking prompts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The configuration enables automatic triggering on every completed task, on a weekly schedule, and additionally during idle windows or autonomous events, but does not define strict scope limits or safe-by-default exclusions. Because this module is explicitly designed to convert experience into persistent memory or skills, overly broad autonomous triggers materially increase the risk of prompt injection persistence, drift in persona/behavior, and unsupervised accumulation of unsafe or low-quality procedures.

Unvalidated Output Injection

High

• Category: Output Handling

Content

tf.write(payload); tfn = tf.name
            with open(tfn + ".sig", "wb") as sf:
                sf.write(sig)
            r = subprocess.run(["openssl", "pkeyutl", "-verify", "-pubin", "-inkey", pub_path,
                                "-in", tfn, "-sigfile", tfn + ".sig"], capture_output=True, text=True)
            os.unlink(tfn); os.unlink(tfn + ".sig")
            if "Signature Verified" not in r.stdout:

• Confidence: 90% confidence
• Finding: The OpenSSL fallback verification path treats verification success as the presence of the exact string 'Signature Verified' in stdout instead of enforcing the subprocess exit status. This is brittle across OpenSSL versions/locales and can cause incorrect acceptance or rejection decisions, undermining the trust decision made by the verifier. In this skill context, the tool is specifically used for ID provenance/authentication, so a faulty verification path is more dangerous than in a non-security-sensitive utility.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.