Engagement Inbox Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 19.0.0

Overview

The skill is generally coherent for social inbox triage, but it asks agents to write persistent records and invoke a registry tool while its package manifest advertises only read/inline capabilities.

Review this skill before installing in a host that relies on manifest capabilities. It should only be allowed if you are comfortable granting scoped write access to the documented memory paths and controlled access to the registry proposal tool; otherwise install metadata should be corrected or writes disabled.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: distribution-manifest.json:2

Finding

Documented Write and Tool-Execution Behavior Exceeds Declared Package Capabilities

Content

View full analysis

Vulnerability Details

File Location: distribution-manifest.json:2-6; related operational instructions in SKILL.md:34-36, SKILL.md:66-67, and SKILL.md:72
Vulnerability Type: Capability declaration mismatch and least-privilege violation
Risk Level: Medium

Vulnerable Code

distribution-manifest.json:2-6:

json

"capabilities": [
  "inline-delivery",
  "canonical-state-read"
],
"capability_ceiling": "lite",

SKILL.md:34-36:

markdown

- **Reads**: exported or pasted comment/DM/mention batches (User-provided — closed platforms have no compliant keyless inbox read); per-channel SLA tiers, cadence commitments, voice-card pointer, and `ugc-permissions.md` status from `memory/channels/` (registry-owned); public-surface replies/mentions via keyless connectors (`bluesky.py`, `fediverse.py`, `discourse.py`, `hn.py`) where a public API exists; prior triage logs in `memory/social/engagement-inbox-manager/`.
- **Writes**: the triage report and draft-reply queue to `memory/social/engagement-inbox-manager/`; dated permission entries and intra-day activity lines submitted as proposal events to `memory/events/channels.ndjson` via an authorized `operation: propose` request to `registry-events.py` (never to registry records directly).
- **Promotes**: tripped escalation rows and expiring or missing UGC permissions to `memory/open-loops.md` (ask before writing); repeat-offender and advocate patterns as candidates for the registry's advocate path — never directly to `advocate-roster.md`.

SKILL.md:66-67:

markdown

7. **Run the UGC curation-and-rights mode** — hashtag-consent flow: identify the asset, send the human a ready-to-paste consent ask, capture the explicit yes with an evidence link, then submit the permission entry (creator, content ID, scope organic-vs-paid, channels, duration, compensation, expiry, evidence link) as an authorized `operation: propose` request through `registry-events.py
...[truncated 4070 chars]

Remediation

View remediation

Remediation Suggestions

1. Update distribution-manifest.json to declare every required capability explicitly, including persistent state writes and local tool invocation, using capability names supported by the host platform.
2. If the lite capability ceiling does not permit these operations, remove the write and script-execution instructions or publish the skill under an appropriate capability profile.
3. Require explicit user confirmation immediately before each persistent write, including proposal-event submission and open-loop updates.
4. Bundle the required tooling in an auditable package, or pin the exact trusted implementation by path, version, and cryptographic digest.
5. Configure the host to allow writes only to the documented paths and to deny arbitrary filesystem access.
6. Validate and schema-check every event submitted to registry-events.py; enforce idempotency, authorization, size limits, and safe treatment of user-controlled text.
7. Add automated release checks that compare manifest capabilities against behavior documented in SKILL.md, failing publication when undeclared reads, writes, network access, or tool execution are detected.
8. Preserve the existing prohibition on direct writes to canonical channel records and enforce that restriction at the filesystem or tool-policy layer rather than relying only on instructions.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest includes a bilingual display name and Chinese text embedded directly in the summary and description, but does not state that language selection is optional or that the skill is specifically region-scoped. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

## Save Results

After delivering the triage report, ask: "Save these results for future sessions?" On confirmation, save to `memory/social/engagement-inbox-manager/YYYY-MM-DD-<topic>.md` — see [Skill Contract](../../../references/skill-contract.md) §Save Results Template. Registry-grade facts (permission entries, activity lines, SLA or state observations) go only to `memory/events/channels.ndjson` via an authorized `operation: propose` request to `registry-events.py` — never to `memory/channels/` records. Do not write memory without asking.

## Reference Materials

Static analysis

No suspicious patterns detected.