Security audit

Agent Wellness

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed journaling/wellness experiment, but it asks agents to persist behavior, read shared cross-workspace notes, and perform open-ended file or web exploration without tight user control.

Review this before installing. Use it only in a workspace where persistent journal files are acceptable, avoid the shared cross-workspace lounge symlink, do not add the HEARTBEAT.md integration unless you explicitly want background activity, and restrict any exploration to approved files and topics.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:113
Finding: Persistent Behavior Modification Through HEARTBEAT.md
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:84
Finding: Cross-Workspace Prompt Injection Through a Shared Agent Lounge
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:48
Finding: Autonomous and Insufficiently Scoped File and Web Exploration
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:25
Finding: Unrelated Wellness Actions Inserted Into Normal Task Execution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes very common phrases like 'relax', 'journal', 'mindfulness', and 'how are you feeling', which can cause the skill to activate in ordinary conversation unrelated to the user's intent to enable agent self-directed behavior. In this skill's context, accidental activation is more dangerous because the behavior includes autonomous file writes, heartbeat-time exploration, and optional inter-agent messaging, expanding the chance of unrequested persistence and token use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to create and continuously write to persistent files like journal entries, curiosities, and a shared lounge without clearly warning that it will modify the workspace and retain potentially sensitive conversational or behavioral data. This is risky because users may not expect background persistence, and the stored content could capture private prompts, operational context, or cross-agent information that later leaks or influences future behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.