Multi-Agent Status

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:02 AM UTC
• Version: 1.0.1

Overview

The skill’s monitoring purpose is coherent, but it asks users to run unpinned external scripts and create a world-writable shared status directory.

Review the remote scripts before use, pin them to a trusted commit or vendor them locally, and replace chmod 777 with least-privilege ownership and permissions such as a dedicated group with 770 or tighter access. Treat the central status directory as operationally sensitive because forged or deleted reports can mislead monitoring and alerts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:49

Finding

World-Writable Status Directory Allows Monitoring Data Tampering

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-50
Vulnerability Type: Insecure filesystem permissions
Risk Level: Medium

Vulnerable Code:

bash

mkdir -p /path/to/agent-status
chmod 777 /path/to/agent-status

Technical Analysis

The setup instructions assign mode 0777 to the shared status directory. This gives every local user read, write, and traversal permissions. Any local account or process can consequently create, replace, rename, or delete agent status reports.

The monitoring workflow later instructs the monitor agent to read all JSON files from this directory and use their contents to generate alerts and dashboard updates. No ownership checks, integrity verification, authentication, or schema validation are specified. The world-writable directory therefore crosses a trust boundary and allows untrusted local users to control monitoring input.

Attack Path

1. An attacker obtains access to any unprivileged local account on the shared host.
2. The attacker accesses /path/to/agent-status, which is writable by all users.
3. The attacker overwrites a legitimate agent report, creates a forged report, or deletes an existing report.
4. The monitor agent reads the attacker-controlled report during its next status check.
5. The forged values are incorporated into alerts or the health dashboard, suppressing a real incident or generating false operational information.

Impact Assessment

Exploitation does not directly grant elevated operating-system privileges, but it compromises the integrity and availability of the entire monitoring data set on the shared host. An unprivileged local user can:

• Falsely report failed agents as healthy.
• Trigger false failure or cron-error alerts.
• Delete reports to make configured agents appear missing.
• Impersonate other agents by creating reports under their names.
• Undermine operational decisions based on the resulting dashboa ...[truncated 96 chars]

Remediation

View remediation

Remediation Suggestions

• Replace mode 0777 with a dedicated service account and group using mode 0770, 0750, or stricter permissions.
• Give each reporting agent only the minimum permission required to submit its own report.
• Prevent reporters from modifying or deleting reports belonging to other agents, such as through separate upload directories or a privileged ingestion service.
• Validate report filenames, JSON schemas, expected agent identities, timestamps, and field types before processing.
• Verify file ownership and reject symbolic links or files owned by unexpected accounts.
• Write reports atomically by creating a securely permissioned temporary file and renaming it into place.
• Where reports cross hosts, authenticate each submitting agent and consider signing reports or validating message authentication codes.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Executable Scripts Are Sourced from an Unpinned External Repository

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43-57
Vulnerability Type: Mutable external executable dependency
Risk Level: Medium

Vulnerable Code:

markdown

**Scripts available in the [Collective Skills repo](https://github.com/Bobalouie44/collective-skills/tree/main/references)**

### 1. Create shared status directory

On your central/shared host:
```bash
mkdir -p /path/to/agent-status
chmod 777 /path/to/agent-status

Scripts are in references/

2. Configure each agent

Copy the script from references/agent-status-report.sh to your preferred location and make it executable:

text

### Technical Analysis

The skill directs users to copy executable scripts from the `main` branch of an external GitHub repository. The reference is not pinned to an immutable commit, and the skill provides no checksum, signature, or other integrity verification mechanism.

The referenced scripts are not included in the audited project, which contains only `SKILL.md` and `_meta.json`. Consequently, their effective contents can change after this version of the skill has been reviewed. Compromise of the external repository or a later upstream modification could introduce commands that were not present during the audit.

The embedded shell and PowerShell examples in `SKILL.md` do not contain a hidden payload. The risk arises specifically from instructing users to obtain and execute potentially different remote versions.

### Attack Path

1. An attacker compromises the external repository or gains authority to modify its `main` branch.
2. The attacker alters `references/agent-status-report.sh` or `references/agent-status-report.ps1` to include malicious commands.
3. A user follows the skill instructions and copies the current remote script without validating its contents or integrity.
4. The user marks the script executable
...[truncated 849 chars]

Remediation

View remediation

Remediation Suggestions

• Bundle the reviewed shell and PowerShell scripts directly in the skill package.
• If external hosting is necessary, reference an immutable commit rather than the mutable main branch.
• Publish and require verification of SHA-256 checksums or cryptographic signatures before execution.
• Document an explicit review step before making downloaded files executable.
• Apply repository protections such as mandatory review, signed commits or releases, and restricted publishing permissions.
• Ensure scheduled jobs invoke only a locally reviewed and integrity-verified copy.
• Re-audit and update the pinned commit and checksum whenever the scripts legitimately change.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The instruction to use chmod 777 is an unsafe parameter choice that weakens access control on a shared monitoring data store. Because the monitor trusts files in this directory as health inputs, any unprivileged local actor with write access could tamper with status JSON, interfere with monitoring, or stage denial-of-service against the alerting workflow.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

On your central/shared host:

bash

mkdir -p /path/to/agent-status
chmod 777 /path/to/agent-status

Scripts are in references/

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs users to create a shared status directory with mode 777, making it world-writable by any local user or process on the host. In this monitoring design, file contents directly drive health dashboards and alerts, so an attacker could forge, overwrite, or delete agent reports to suppress failures, trigger false alarms, or poison operational decisions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

On your central/shared host:

bash

mkdir -p /path/to/agent-status
chmod 777 /path/to/agent-status

Scripts are in references/

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The documentation instructs remote agents to push JSON reports to another host using SCP, and earlier lines state those reports include active project information and health state. The markdown does not explicitly disclose that agent/system metadata is being centralized and transmitted across hosts, which is a user-relevant privacy and operational warning.

Content

No source excerpt is available for this finding.