workflow-monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:48 AM UTC
• Version: 1.9.19

Overview

The skill’s monitoring purpose is coherent, but it can publish raw workflow evidence to external issue trackers with weak redaction and optional approval bypass.

Review this skill before installing in private or production repositories. Keep auto_create_issues disabled, inspect generated issue bodies before submission, and avoid using it where workflow output may contain tokens, credentials, customer data, internal paths, or sensitive logs unless a separate redaction process is enforced.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: modules/issue-templates.md:18

Finding

Unredacted Workflow Evidence May Be Published to External Issue Trackers

Content

View full analysis

Vulnerability Details

File Location: modules/issue-templates.md:18-46
Additional Locations: SKILL.md:71-73, SKILL.md:86-89, SKILL.md:133-135; modules/detection-patterns.md:118-140; modules/issue-templates.md:171-185
Vulnerability Type: Sensitive information exposure through unredacted evidence collection and publication
Risk Level: Medium

Vulnerable Code

markdown

## Error Report Template

```markdown
## Background

Detected during workflow execution on {{DATE}}.

**Source:** {{WORKFLOW_NAME}} session {{SESSION_ID}}
**Severity:** {{SEVERITY}}

## Problem

{{ERROR_DESCRIPTION}}

**Command:**

{{COMMAND}}

text

**Output:**

{{OUTPUT_EXCERPT}}

text

**Exit code:** {{EXIT_CODE}}

## Context

- Previous operation: {{PREVIOUS_OP}}
- Working directory: {{WORKING_DIR}}
- Environment factors: {{ENV_NOTES}}

The skill also directs the agent to collect and link potentially sensitive evidence:

text

1. Log execution events - Commands, outputs, timing
2. Tag anomalies - Failures, timeouts, inefficiencies
3. Store evidence - For reproducibility

Issue publication can be configured to occur without case-by-case approval:

yaml

auto_create_issues: false  # Require approval before creating

Technical Analysis

The skill collects raw command lines, command output, working directories, environment notes, session identifiers, and surrounding execution context. These values are inserted directly into issue templates without a required sanitization or secret-redaction stage.

Workflow commands and their output commonly contain sensitive values, including:

• Access tokens passed through command-line arguments
• Authentication headers or signed URLs
• Credentials printed by failing tools
• Private repository names and source fragments
• Internal hostnames, user names, and filesystem paths
• Environment configuration or deploym ...[truncated 2441 chars]

Remediation

View remediation

Remediation Suggestions

1. Add mandatory redaction before evidence storage and rendering

   • Detect common token, password, private-key, authorization-header, signed-URL, and connection-string formats.
   • Replace detected values with stable placeholders such as [REDACTED_TOKEN].
   • Redact secrets from both command arguments and output excerpts.

2. Use an allowlist-based evidence model

   • Publish only explicitly approved fields.
   • Exclude raw environment data by default.
   • Normalize working directories so user names and sensitive path components are removed.
   • Avoid including complete commands when a sanitized command name and non-sensitive arguments are sufficient.

3. Limit evidence volume

   • Truncate output excerpts to a conservative size.
   • Select only lines directly relevant to the failure.
   • Store detailed evidence locally in a protected location rather than embedding it in remote issues.

4. Require explicit approval for external publication

   • Do not allow auto_create_issues to bypass review when evidence fields are present.
   • Present the exact sanitized issue body to the user before submission.
   • Require separate confirmation when the destination repository is public.

5. Validate the publication destination

   • Determine repository visibility before creating an issue.
   • Block automatic publication to public repositories.
   • Apply the principle of least privilege to GitHub or GitLab credentials.

6. Add automated security tests

   • Test redaction of GitHub tokens, cloud credentials, bearer tokens, private keys, passwords, signed URLs, and connection strings.
   • Verify that secrets cannot survive template rendering.
   • Add regression tests for multiline and encoded secret formats.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list is broad enough to activate in many routine workflow or monitoring contexts, which increases the chance this skill runs unexpectedly and performs external side effects like preparing or filing issues. In this skill, that risk is amplified because the documented behavior includes analyzing session activity and interacting with a git platform, so overbroad activation can cause unintended data sharing or noisy issue creation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description does not clearly warn users that it may create issues on GitHub/GitLab and include workflow evidence, outputs, or session metadata in those reports. Because the skill processes execution logs and links evidence, missing disclosure can lead to unintended external sharing of sensitive operational data, especially if auto-creation is enabled or hooks invoke it automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The issue templates explicitly embed raw command text, output excerpts, working directory, and session identifiers into GitHub issues, which can disclose sensitive internal information to anyone with repository issue access. In a workflow-monitoring skill, these fields can easily contain secrets, tokens, filesystem paths, proprietary commands, customer data, or other operational details, and there is no warning, masking, or sanitization step before publication.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.