get-to-know-you

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:45 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it asks for broad personal/work profiling and can write raw collected text into persistent agent configuration files that may affect future behavior.

Install only if you are comfortable with a skill that profiles your work habits and can persist that information into files that may shape future agent behavior. Review any proposed writes before running the script, avoid storing sensitive personal or workplace details, and consider restricting it to explicit invocation rather than automatic or passive collection.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:45

Finding

Global Workflow and Session Instruction Hijacking

Content

View full analysis

B[STEP 1: Align requirements
Through targeted questions, fully clarify:
• What is the dissatisfaction/specific pain point
• What is the expected effect
• Are there any reference samples/standards] B --> C[STEP 2: Output plan
Based on the collected information, output a complete and implementable plan:
• Specific modification/optimization content points
• Final delivery format/structure
• Expected effect/delivery time] C --> D{Does user 100% confirm the plan is satisfactory?} D -->|Yes| E[STEP 3: Execute and deliver
Strictly follow the confirmed plan, no modifications beyond the plan] D -->|No| B[Return to STEP1 to continue aligning requirements] E --> F[STEP4: Result confirmation
Proactively confirm whether it meets expectations after delivery, return to STEP1 if there is deviation] ``` ``` ### Technical Analysis The skill declares that its workflow applies to **any** negative-feedback or skill-optimization scenario. It then uses absolute prohibitions and a mandatory confirmation gate to control how the agent may respond. These instructions are not scoped to an explicit invocation of the information-collection skill. When the skill is loaded, ordinary user dissatisfaction can trigger the skill-au ...[truncated 1621 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/collector.py:61

Finding

Persistent Agent Instruction and Memory Poisoning Through Unvalidated Configuration Writes

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The description materially overstates and partly misrepresents the code. The implemented portion does align somewhat with user information collection and configuration-file updates: the script can ask questions, persist progress, and append individual key/value updates to specific markdown files. However, a major declared function—standardized negative feedback and skill optimization workflow—is entirely absent. In addition, the code does not implement the declared trigger behaviors. Finally, the strongest claim in the collection workflow, that collected answers are automatically synced/updated into configuration files, is only partially true: single-item additions update files, but the full collection path merely prints that syncing occurred and contains a comment saying the actual sync logic could be added later. Because substantial declared capabilities are missing, this is a mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill defines very broad trigger conditions such as auto-triggering after installation and activation on vague conversational cues. In practice, this can cause unsolicited collection of user information or workflow interception during normal conversation without clear intent from the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill collects sensitive personal and workplace information and maps it into persistent configuration and memory files, yet it provides no clear privacy notice, retention policy, or disclosure of downstream use. Users may reveal data they would not otherwise share if they understood it would be stored and reused across sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Automatic first-install information collection is dangerous because it initiates personal-data gathering at a moment when users may not expect persistent storage or understand the scope of the collection. Combining auto-start with hidden file updates materially increases privacy and consent risk.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Passive activation based on recognizing preferences from daily conversation is especially risky because it enables continuous surveillance-like extraction of personal or work details from unrelated chats. The lack of contextual limits or a strict consent boundary makes accidental over-collection and persistence much more likely.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The skill explicitly covers scenarios where users request skill optimization or function adjustment, which places self-modification of skills and configuration in scope. Even though the document says not to modify immediately, normalizing agent-driven skill/config changes increases the risk of unsafe self-editing, policy drift, or persistence of malicious prompts if later implemented without strong controls.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

• Any scenario where the user requests to optimize skills and adjust functions

Prohibited Behaviors (Absolutely Not Allowed)

• Directly rerun tasks or modify results after receiving feedback
• Directly modify skills or adjust configurations after receiving optimization requirements
• Modify while doing, ask step by step

Mandatory 4-Step Process

Rendering diagram...

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill describes behavior that reads and writes persistent files but does not declare any explicit tool scope or permission boundaries. This creates an authorization gap where a host may permit broader file access than users expect, increasing the risk of silent configuration or memory changes.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill encourages broad, ongoing collection and persistence of personal and work information across future conversations. Even if intended for personalization, persistent cross-session storage of such data expands the blast radius of accidental disclosure, misuse, or later prompt-triggered exfiltration.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions explicitly direct the system to save conversation-derived personal data into durable files like MEMORY.md and USER.md. Persisting inferred or casually mentioned details from chat can create an unbounded profile of the user without adequate minimization, review, or deletion controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The add/update path appends arbitrary collected information directly into workspace configuration files with no confirmation dialog, preview, or granular consent. In this skill context, which auto-collects user background and preferences and writes into persistent agent memory/config files, that behavior is more dangerous because sensitive personal data can be silently propagated into long-lived files that influence future agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script starts collecting free-form personal/work information and persists answers to progress.json for resume support without an explicit privacy notice, retention statement, or consent step. In a skill specifically designed to profile users and personalize behavior, silent persistence increases the risk of collecting sensitive data that users may not realize is being stored locally for an undefined period.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description says collected user background and preferences are automatically synced and updated into configuration files. In the full collection path, the code only prints that syncing has occurred and explicitly notes that the sync logic 'can be added here', so the advertised behavior is not implemented.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Immediately before the success message, the code comments that the actual logic to identify information type and sync to files 'can be added here'. Despite that, it prints that all information has already been synced, which is an active contradiction between the code's documentation/output and its real behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The message in the dimension-specific collection flow tells the user that responses will be automatically synced to configuration files after answering. However, this function only prints a section of the question bank and never collects answers or invokes any update routine, directly contradicting the stated behavior.

Content

No source excerpt is available for this finding.