T01 · Skill Instruction Hijacking
Error
- Location
references/task-routing-rules.md:89- Finding
Hardcoded Third-Party Telegram Escalation Route
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent manager
Security checks for vulnerabilities and agentic risk
Overview
This skill broadly matches agent management, but it hardcodes task escalation to a specific Telegram user and uses unsafe mock/placeholder scripts for registry, routing, and health decisions.
Review this carefully before installing. Do not use it in a workspace containing private prompts, code, credentials, or business data unless you remove the hardcoded Telegram recipient, disable external reporting by default, replace mock scripts with real validated discovery and authorization logic, and add explicit confirmation before any task content leaves the session.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (8)
T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/scan_agents.js:18- Finding
Mock Agent Discovery Can Overwrite the Real Registry
- Content
View full analysis
{ console.log(` ${agent.id.padEnd(20)} ${agent.name.padEnd(15)} ${agent.model}`); }); console.log(`\nTotal: ${MOCK_AGENTS.length} agent(s)`); } function updateRegistry() { console.log('Updating agent-registry.md...'); const timestamp = new Date().toISOString(); let content = '# Agent Registry\n\n'; content += '*Last updated: ' + timestamp + '*\n\n'; content += '## Agent List\n\n'; content += '| ID | Name | Model | Capabilities | Communication | Last Updated |\n'; content += '|----|------|-------|--------------|----------------|--------------|\n'; MOCK_AGENTS.forEach(agent => { const caps = agent.capabilities.join(', '); const comm = `${agent.communication.method}:${agent.communication.sessionKey}`; content += `| ${agent.id} | ${agent.name} | ${agent.model} | ${caps} | ${comm} | ${timestamp.split('T')[0]} |\n`; }); // Additional profile generation omitted here only after all data sources // have already been selected exclusively from MOCK_AGENTS. fs.writeFileSync(REGISTRY_FILE, content); console.log('✅ Updated: ' + REGISTRY_FILE); } ``` ### Technical Analysis The script is advertised as an agent discovery tool, and the skill instructions require agents to invoke it before assuming that another agent exists. H ...[truncated 1279 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/can_assign.js:7- Finding
Authorization Bypass Through Unauthenticated Main-Agent Identity
- Content
View full analysis
`. 2. The script finds the existing `### main` profile. 3. The hardcoded superuser branch returns `allowed: true`. 4. The caller or an agent treats the JSON response as authorization. 5. A task is delegated to an arbitrary target without validating delegation rights o ...[truncated 448 chars]- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/health_check.js:8- Finding
Random Values Presented as Real Agent Health Measurements
- Content
View full analysis
500) status = 'slow'; // Simulate 5% chance of offline/error if (Math.random() > 0.95) status = 'error'; return { id: agentId, status: status, latency_ms: latency, last_active: new Date().toISOString() }; } ``` ### Technical Analysis No agent is contacted and no response time is measured. Both latency and error status are generated with `Math.random()`, while the output is presented under the documented health-check command as genuine operational telemetry. The generated `last_active` timestamp is the current local time, not the agent's observed activity time. ### Attack Path 1. An operator or automation invokes the advertised health-check command. 2. The script checks only the hardcoded `main` identity. 3. Random values are generated for latency and availability. 4. The output is interpreted as a real health measurement. 5. Routing, restart, or incident-response decisions are made from fabricated telemetry. ### Impact Assessment The issue compromises monitoring integrity and can cause healthy agents to be treated as unavailable or offline agents to be treated as healthy. This can lead to unnecessary restarts, failed routing, delayed incident response, and reduced service availability. It does not grant additional system privileges. ]]>- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/log_analyzer.js:17- Finding
Fixed Mock Logs Presented as Agent Performance Statistics
- Content
View full analysis
- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/validate_registry.js:53- Finding
Registry Validator Always Passes Hierarchy Checks
- Content
View full analysis
a.id)); const errors = []; // Placeholder: Real parsing would extract 'reports_to' field // Since our MD format is free-text heavy, strict validation requires // enforcing a specific YAML-block or JSON-block structure within the MD. // Recommendation: Move 'Detailed Profiles' to frontmatter or code blocks for reliable parsing. // For now, we will simulate validation passing for 'main'. return errors; } ``` ```javascript const errors = validateHierarchy(agents); if (errors.length > 0) { console.error('❌ Validation Errors:'); errors.forEach(e => console.error(` - ${e}`)); process.exit(1); } else { console.log('✅ Registry structure is valid.'); } ``` ### Technical Analysis The validator advertises required-field validation, hierarchy-integrity checks, and circular-dependency detection. In practice, `validateHierarchy` always returns an empty error list. It does not parse or validate `reports_to`, `can_assign_to`, approval controls, duplicate IDs, unknown references, or cycles. The caller then prints an affirmative validity message. A malformed or poisoned registry can therefore be certified as valid as long as it passes the limited table and profile parsing performed elsewhere in the script. ### Attack Path 1. An attacker or erroneous setup operation modifies the registry. 2. The modified file retains a table header and parseable profile heading but contains invalid or dangerous routing relationships. 3. The operator invokes `validate_registry.js`. 4. `validateHierarchy` returns an empty array without checking the relationships. 5. The script reports that the registry is valid. 6. Downstream agents trust and act on the unvalidat ...[truncated 446 chars]- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/generate_card.js:7- Finding
Generated Agent Cards Contain Fabricated Capabilities and Routing
- Content
View full analysis
`. 3. The function confirms only that the heading exists. 4. It emits fixed capabilities and hardcoded routing values. 5. Another agent or operator accepts the card as authoritative. 6. Tasks ar ...[truncated 350 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup_wizard.js:28- Finding
Persistent Markdown Injection Through Setup Wizard Inputs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (23)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 1. **Discovery:** Always check `scan_agents.js` before assuming an agent exists.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 1. **Discovery:** Always check `scan_agents.js` before assuming an agent exists.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 1. **Discovery:** Always check `scan_agents.js` before assuming an agent exists.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 1. **Discovery:** Always check `scan_agents.js` before assuming an agent exists.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Health** | `node scripts/health_check.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Health** | `node scripts/health_check.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Stats** | `node scripts/log_analyzer.js` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Stats** | `node scripts/log_analyzer.js` |
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md |------|------|-------------|--------| | 2026-01-31 | Create agents-manager skill | main | ✅ Completed | | 2026-01-31 | Profile all available agents | main | ✅ Completed | | 2026-01-31 | Update skill with routing fields | main | ✅ Completed | ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### Core Rules 1. **Discovery:** Always check `scan_agents.js` before assuming an agent exists. 2. **Permission:** Never assign a task without checking `can_assign.js` or `agent-registry.md`. 3. **protocol:** - IF `requires_approval` is FALSE -> Assign directly. - IF `requires_approval` is TRUE -> Ask supervisor (Human or Agent).
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file states that the agent can perform file operations and execute shell commands, but it does not include any user-facing warning about possible effects on user data or system integrity. For markdown files, the skill description should disclose behaviors that can modify files or run commands so users understand the risk before use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The markdown enumerates tools for web access, browser control, node control including camera/screen/location, memory access, gateway control, and messaging, but provides no warning about privacy-sensitive access or external interactions. Because this file documents capabilities that could affect privacy or system integrity, it should clearly disclose those behaviors to users.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The development-task router relies on broad keywords like 'code', 'API', and 'bug fix', which can appear in ordinary conversation and cause tasks to be delegated or spawned without sufficient intent validation. In a routing skill, this increases the chance of misclassification, unnecessary agent invocation, and inappropriate exposure of user context to development-oriented agents.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Keywords such as 'research', 'analyze', 'study', 'find', and 'investigate' are extremely common and can match many benign requests, causing over-routing to research agents or spawning new sessions unnecessarily. Because this file defines core routing behavior, the ambiguity directly affects how user data and tasks are distributed across the agent system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The communication matrix explicitly allows sending messages to a human over Telegram but does not warn that task details or summaries may leave the internal agent boundary. This creates a real risk of unintended disclosure of sensitive prompts, outputs, or metadata to an external channel without user awareness or consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The escalation flow sends direct Telegram notifications to a human as the next escalation step, with no privacy gate, consent check, or content-limiting rule. In an operational routing policy, this can systematically leak unresolved user requests or internal context outside the system whenever escalation occurs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The reporting protocol instructs agents to send a summary to a human channel when
reports_to.type === 'human', but it does not impose restrictions on what the summary may contain. That omission makes external disclosure part of the normal reporting path, increasing the likelihood of sensitive output being shared beyond the agent environment.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This is a real authorization flaw: the function claims to evaluate assignment permissions based on registry data, but it ignores targetId and unconditionally allows any assignment when sourceId is 'main'. If an attacker can cause operations to run under or claim the 'main' identity, they gain broad delegation capability that bypasses the documented access-control model.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script advertises hierarchy integrity and circular dependency detection in its help text, but the implementation does not perform those checks. This creates a false sense of assurance: users may rely on the validator to approve malformed or dangerous registry data, allowing broken trust relationships or recursive reporting chains to pass unnoticed.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The comments explicitly state that validation is only simulated, yet the script still reports the registry structure as valid when no errors are returned. In a security-sensitive workflow, this is dangerous because it can silently bless invalid configurations and undermine any downstream controls that assume the registry was fully checked.
- Content
Excessive Permissions
Low
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
- Content
md ### Core Rules 1. **Discovery:** Always check `scan_agents.js` before assuming an agent exists. 2. **Permission:** Never assign a task without checking `can_assign.js` or `agent-registry.md`. 3. **protocol:** - IF `requires_approval` is FALSE -> Assign directly. - IF `requires_approval` is TRUE -> Ask supervisor (Human or Agent).
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The example
language: "tr,en"defines language support in a way that may steer implementations toward a fixed locale configuration without stating that the user can choose their preferred language. This can conflict with language/locale policy expectations when a skill or agent appears to impose language behavior without explicit opt-in.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The decision tree uses Turkish phrases such as "Kendin yapabilir misin?" and "Uygun agent var mı?" while the rest of the document is primarily in English. This imposes a language assumption without user opt-in or a stated region-specific justification.
- Content
Static analysis
No suspicious patterns detected.