Momentum Planner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 19.0.0

Overview

The skill appears to be a legitimate launch-planning assistant, but its instructions ask for persistent memory writes and registry proposals that are not declared in its lite/read-only capability manifest.

Install only if you are comfortable with this skill creating or proposing persistent launch-planning records after confirmation. The main issue is not hidden malicious code, but that the package metadata understates the write authority described in the skill instructions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:38

Finding

Persistent-State Write Operations Exceed the Declared Capability Ceiling

Content

View full analysis

Vulnerability Details

File Location: distribution-manifest.json:2-6; SKILL.md:38-39, 67-68, 74
Vulnerability Type: Capability declaration mismatch and violation of least privilege
Risk Level: Medium

The distribution manifest declares only inline delivery and canonical-state read access:

json

"capabilities": [
  "inline-delivery",
  "canonical-state-read"
],
"capability_ceiling": "lite",

However, the Skill contract directs the agent to perform persistent-state writes and invoke registry tooling:

markdown

- **Writes**: a user-facing momentum plan + a reusable summary to `memory/launch/momentum-planner/`; next-moment and date facts to `memory/events/launches.ndjson` via an authorized `operation: propose` request to `registry-events.py` for launch-registry to formalize — this skill never writes the calendar or dossiers directly.
- **Promotes**: the chosen next Tier-1 moment, the announcement-tier routing rule, and the relaunch verdict to `memory/hot-cache.md` and `memory/open-loops.md` (ask before writing); propose durable cadence choices as pending-decision items — do not write `decisions.md` directly.

Additional instructions require proposals that can modify persistent event state:

markdown

7. **Book the next Tier-1 moment** — name the candidate and check its spacing against the last Tier-1 moment in `memory/launch-registry/calendar.md`. Too-tight stacking is the `M` launch-stacking guardrail: flag it as an audience-fatigue risk with the dates, not as a veto. If no calendar record exists, mark the spacing check NEEDS_INPUT. Submit the moment to `memory/events/launches.ndjson` via an authorized `operation: propose` request to `registry-events.py`.
8. **Claims hygiene** — every milestone or comparative number destined for an announcement is a claim: mark it `[needs source]` and submit it to `memory/events/claims.ndjson` via an authorized `operation: propose` request to `registry-events.py`. This skill never adjudicates subs
...[truncated 3741 chars]

Remediation

View remediation

Remediation Suggestions

1. Update distribution-manifest.json to declare every required persistent-state write and tool-execution capability using capability names supported by the host.
2. Raise the capability ceiling if persistent writes or local tool invocation are incompatible with the lite profile.
3. If the Skill is intended to remain read-only, remove all direct write and script-invocation instructions. Return proposed records inline and require a separately authorized writer Skill to persist them.
4. Enforce manifest capabilities at runtime rather than relying solely on instructional compliance. Deny filesystem writes and tool calls that are not explicitly declared.
5. Require explicit, narrowly scoped user approval immediately before each write, including the destination path and exact proposed content.
6. Restrict registry-events.py to an allowlist of approved operations and destination stores, validate all fields, reject path traversal, and prevent arbitrary command or argument injection.
7. Treat user-provided analytics, changelogs, and community content as data only. Sanitize and validate it before incorporating it into persistent records.
8. Add automated package validation that compares file and tool operations described in SKILL.md with the manifest's declared capabilities and rejects inconsistent packages.
9. Audit the externally referenced registry-events.py and downstream memory consumers separately, because they are not included in this artifact.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

## Save Results

On user confirmation, save to `memory/launch/momentum-planner/YYYY-MM-DD-<launch-slug>-momentum-plan.md` — see [Skill Contract](../../../references/skill-contract.md) §Save Results Template; ask "Save these results for future sessions?" first. Next-moment and date facts go to `memory/events/launches.ndjson` via an authorized `operation: propose` request to `registry-events.py` only; milestone claims to `memory/events/claims.ndjson` via an authorized `operation: propose` request to `registry-events.py`. Do not write memory without asking.

## Reference Materials

Static analysis

No suspicious patterns detected.