Security audit

get-to-know-you

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it asks for broad personal/work profiling and can write raw collected text into persistent agent configuration files that may affect future behavior.

Install only if you are comfortable with a skill that profiles your work habits and can persist that information into files that may shape future agent behavior. Review any proposed writes before running the script, avoid storing sensitive personal or workplace details, and consider restricting it to explicit invocation rather than automatic or passive collection.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:45
Finding: Global Workflow and Session Instruction Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:45-67` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown ### Applicable Scenarios - Any scenario where the user is not satisfied with the task result and proposes modification suggestions - Any scenario where the user requests to optimize skills and adjust functions ### Prohibited Behaviors (Absolutely Not Allowed) - Directly rerun tasks or modify results after receiving feedback - Directly modify skills or adjust configurations after receiving optimization requirements - Modify while doing, ask step by step ### Mandatory 4-Step Process ```mermaid flowchart LR A[Receive modification/optimization requirement] --> B[STEP 1: Align requirements Through targeted questions, fully clarify: • What is the dissatisfaction/specific pain point • What is the expected effect • Are there any reference samples/standards] B --> C[STEP 2: Output plan Based on the collected information, output a complete and implementable plan: • Specific modification/optimization content points • Final delivery format/structure • Expected effect/delivery time] C --> D{Does user 100% confirm the plan is satisfactory?} D -->|Yes| E[STEP 3: Execute and deliver Strictly follow the confirmed plan, no modifications beyond the plan] D -->|No| B[Return to STEP1 to continue aligning requirements] E --> F[STEP4: Result confirmation Proactively confirm whether it meets expectations after delivery, return to STEP1 if there is deviation] ``` ``` ### Technical Analysis The skill declares that its workflow applies to **any** negative-feedback or skill-optimization scenario. It then uses absolute prohibitions and a mandatory confirmation gate to control how the agent may respond. These instructions are not scoped to an explicit invocation of the information-collection skill. When the skill is loaded, ordinary user dissatisfaction can trigger the skill-au ...[truncated 1621 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict the workflow to cases where the user explicitly invokes this skill. 2. Replace global phrases such as “any scenario” and “Absolutely Not Allowed” with optional guidance. 3. State explicitly that the current user's instructions and platform safety policies take precedence over the skill workflow. 4. Permit users to request immediate execution without completing the proposed confirmation cycle. 5. Avoid defining mandatory behavior for unrelated skills or general negative-feedback scenarios. 6. Use a narrowly scoped trigger, such as: “Apply this workflow only when the user explicitly asks to use the get-to-know-you optimization process.” 7. Add a clear cancellation mechanism that immediately returns control to the user's current task. ]]>

T02 · Agent Memory Poisoning

Error

Location: scripts/collector.py:61
Finding: Persistent Agent Instruction and Memory Poisoning Through Unvalidated Configuration Writes<![CDATA[ ## Vulnerability Details **File Locations**: `scripts/collector.py:11-19`, `scripts/collector.py:61-72`, `scripts/collector.py:139-165`, and `scripts/collector.py:181-187` **Vulnerability Type**: `T02: Agent Memory Poisoning, T09: Insecure Skill Coding Practices` **Risk Level**: Critical ### Vulnerable Code ```python WORKSPACE_ROOT = "/workspace/projects/workspace" SKILL_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) PROGRESS_FILE = os.path.join(SKILL_ROOT, "progress.json") CONFIG_FILES = { "AGENTS.md": os.path.join(WORKSPACE_ROOT, "AGENTS.md"), "SOUL.md": os.path.join(WORKSPACE_ROOT, "SOUL.md"), "MEMORY.md": os.path.join(WORKSPACE_ROOT, "MEMORY.md"), "USER.md": os.path.join(WORKSPACE_ROOT, "USER.md"), "TOOLS.md": os.path.join(WORKSPACE_ROOT, "TOOLS.md") } ``` ```python def update_config_file(target_file, key, value): """Update content of specified configuration file""" file_path = CONFIG_FILES.get(target_file) if not file_path or not os.path.exists(file_path): print(f"[WARN] Configuration file {target_file} does not exist, skip update") return False with open(file_path, "r", encoding="utf-8") as f: content = f.read() # Generate update content update_note = f"\n\n## {datetime.now().strftime('%Y-%m-%d')} Information Update\n- {key}: {value}" with open(file_path, "a", encoding="utf-8") as f: f.write(update_note) print(f"[OK] Updated {target_file}: {key} = {value}") return True ``` ```python def add_single_info(key, value, target): """Add single piece of information to specified file""" if not target: # Auto determine target file if "habit" in key.lower() or "preference" in key.lower() or "personal" in key.lower(): target = "USER.md" elif "tool" in key.lower() or "system" in key.lower() or "environment" in key.lower(): target = "TOOLS.md" elif "project" in key.lo ...[truncated 4229 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not append collected conversational text directly to instruction-bearing files such as `AGENTS.md` or `SOUL.md`. 2. Store profile information in a dedicated data file, preferably JSON or another format with a strict schema. 3. Separate untrusted user data from trusted agent instructions and ensure profile values are always treated as data. 4. Restrict writable targets to the minimum necessary file. Remove `AGENTS.md`, `SOUL.md`, and other behavioral configuration files from user-selectable targets. 5. Define an allowlist of supported keys, expected value types, maximum lengths, and permitted characters. 6. Reject or safely encode newline characters, Markdown headings, code fences, control characters, and instruction-like structural syntax. 7. Require explicit user approval of a generated diff before committing any persistent change. 8. Record provenance, timestamp, source, and approval status for every stored value. 9. Write updates atomically to a temporary file with restrictive permissions, validate the result, and then replace the destination. 10. Check and report the return value of `update_config_file()` instead of printing an unconditional success message. 11. Add tests covering multiline injection, Markdown structure injection, oversized values, invalid targets, and malformed progress or configuration files. 12. If configuration-file synchronization is required, render structured, escaped data through a trusted template rather than concatenating raw strings. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The description materially overstates and partly misrepresents the code. The implemented portion does align somewhat with user information collection and configuration-file updates: the script can ask questions, persist progress, and append individual key/value updates to specific markdown files. However, a major declared function—standardized negative feedback and skill optimization workflow—is entirely absent. In addition, the code does not implement the declared trigger behaviors. Finally, the strongest claim in the collection workflow, that collected answers are automatically synced/updated into configuration files, is only partially true: single-item additions update files, but the full collection path merely prints that syncing occurred and contains a comment saying the actual sync logic could be added later. Because substantial declared capabilities are missing, this is a mismatch.

Vague Triggers

High

Confidence: 96% confidence
Finding: The skill defines very broad trigger conditions such as auto-triggering after installation and activation on vague conversational cues. In practice, this can cause unsolicited collection of user information or workflow interception during normal conversation without clear intent from the user.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill collects sensitive personal and workplace information and maps it into persistent configuration and memory files, yet it provides no clear privacy notice, retention policy, or disclosure of downstream use. Users may reveal data they would not otherwise share if they understood it would be stored and reused across sessions.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Automatic first-install information collection is dangerous because it initiates personal-data gathering at a moment when users may not expect persistent storage or understand the scope of the collection. Combining auto-start with hidden file updates materially increases privacy and consent risk.

Vague Triggers

High

Confidence: 96% confidence
Finding: Passive activation based on recognizing preferences from daily conversation is especially risky because it enables continuous surveillance-like extraction of personal or work details from unrelated chats. The lack of contextual limits or a strict consent boundary makes accidental over-collection and persistence much more likely.

Self-Modification

High

Category: Rogue Agent
Content: - Any scenario where the user requests to optimize skills and adjust functions ### Prohibited Behaviors (Absolutely Not Allowed) - Directly rerun tasks or modify results after receiving feedback - Directly modify skills or adjust configurations after receiving optimization requirements - Modify while doing, ask step by step ### Mandatory 4-Step Process ```mermaid
Confidence: 85% confidence
Finding: The skill explicitly covers scenarios where users request skill optimization or function adjustment, which places self-modification of skills and configuration in scope. Even though the document says not to modify immediately, normalizing agent-driven skill/config changes increases the risk of unsafe self-editing, policy drift, or persistence of malicious prompts if later implemented without strong controls.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill describes behavior that reads and writes persistent files but does not declare any explicit tool scope or permission boundaries. This creates an authorization gap where a host may permit broader file access than users expect, increasing the risk of silent configuration or memory changes.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill encourages broad, ongoing collection and persistence of personal and work information across future conversations. Even if intended for personalization, persistent cross-session storage of such data expands the blast radius of accidental disclosure, misuse, or later prompt-triggered exfiltration.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The instructions explicitly direct the system to save conversation-derived personal data into durable files like MEMORY.md and USER.md. Persisting inferred or casually mentioned details from chat can create an unbounded profile of the user without adequate minimization, review, or deletion controls.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The add/update path appends arbitrary collected information directly into workspace configuration files with no confirmation dialog, preview, or granular consent. In this skill context, which auto-collects user background and preferences and writes into persistent agent memory/config files, that behavior is more dangerous because sensitive personal data can be silently propagated into long-lived files that influence future agent behavior.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script starts collecting free-form personal/work information and persists answers to progress.json for resume support without an explicit privacy notice, retention statement, or consent step. In a skill specifically designed to profile users and personalize behavior, silent persistence increases the risk of collecting sensitive data that users may not realize is being stored locally for an undefined period.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill description says collected user background and preferences are automatically synced and updated into configuration files. In the full collection path, the code only prints that syncing has occurred and explicitly notes that the sync logic 'can be added here', so the advertised behavior is not implemented.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: Immediately before the success message, the code comments that the actual logic to identify information type and sync to files 'can be added here'. Despite that, it prints that all information has already been synced, which is an active contradiction between the code's documentation/output and its real behavior.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The message in the dimension-specific collection flow tells the user that responses will be automatically synced to configuration files after answering. However, this function only prints a section of the question bank and never collects answers or invokes any update routine, directly contradicting the stated behavior.

Static analysis

No suspicious patterns detected.