progressive-loading

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:50 AM UTC
• Version: 1.9.19

Overview

The skill is mostly documentation for progressive module loading, but it includes under-scoped examples for persistent macOS services and unvalidated local Markdown loaders.

Install only if you are comfortable with a broad authoring-pattern skill. Treat its launchd/service and loader snippets as examples that need hardening before use: require explicit user confirmation, avoid root/system service paths unless specifically requested, validate executable paths, allowlist module names, and constrain file reads to the intended module directory.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: modules/macos-patterns.md:75

Finding

Persistent macOS Launch Agent Registration Without Adequate Safety Gates

Content

View full analysis

Label com.example.myagent ProgramArguments /usr/local/bin/myagent RunAtLoad ``` ```text User-scoped agents go in `~/Library/LaunchAgents/`. System-scoped daemons go in `/Library/LaunchDaemons/` and require root. Load with `launchctl load -w `, unload with `launchctl unload`. ``` ### Technical Analysis The module documents the essential components needed to register an executable as a persistent macOS `launchd` service: - `ProgramArguments` specifies the executable launched by the service. - `RunAtLoad` causes execution when the service is loaded. - Placement under `~/Library/LaunchAgents/` enables per-user startup persistence. - Placement under `/Library/LaunchDaemons/` enables system-wide persistence and requires elevated privileges. - `launchctl load -w` persistently enables the service. The declared purpose of the Skill is progressive module loading and token-budget management. Installing an operating-system startup service is not necessary for that purpose and exceeds its minimum required privileges. The documentation does not require explicit user authorization before registration, validate the executable's ownership or provenance, restrict deployment to user scope, or require review of the generated property list. Although the Skill does not automatically execute this command, an ...[truncated 1346 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: modules/large-reference.md:74

Finding

Path Traversal in Reference Section Loader

Content

View full analysis

str: path = REFERENCE_ROOT / f"{name}.md" if not path.exists(): return f"# Missing section: {name}\n" return path.read_text(encoding="utf-8") ``` ### Technical Analysis The `name` parameter is concatenated into a filesystem path without validation. `pathlib.Path` does not automatically constrain the resulting path to `REFERENCE_ROOT`. Directory components such as `..` are therefore preserved and resolved by the filesystem when the file is accessed. For example, a name such as `../../sensitive` produces: ```text modules/reference/../../sensitive.md ``` This path resolves outside `modules/reference`. If the target exists and is readable, `read_text()` loads its contents into the Agent's context. The existence check does not provide a security boundary because it checks the attacker-influenced path. The `.md` suffix limits the issue to paths that can be represented with that suffix, but sensitive project notes, instructions, reports, or configuration documentation may still be exposed. ### Attack Path 1. An attacker influences a reference section identifier through a document, index entry, user request, or model-generated module name. 2. The crafted identifier contains traversal components such as `../../sensitive`. 3. `load_section()` constructs a path outside `modules/reference`. 4. `path.exists()` succeeds if the escaped target exists. 5. `path.read_text()` reads the unintended file. 6. The file content is inserted into the Agent's context and may be disclosed in subsequent output or treated as instructions. ### Impact Assessment Successful exploitation provides read access to `.md` files available to the ...[truncated 335 chars]

Remediation

View remediation

str: filename = SECTIONS.get(name) if filename is None: raise ValueError(f"Unknown reference section: {name}") path = (REFERENCE_ROOT / filename).resolve() if not path.is_relative_to(REFERENCE_ROOT): raise ValueError("Reference path escapes the approved root") if not path.is_file(): return f"# Missing section: {name}\n" return path.read_text(encoding="utf-8") ``` Additional hardening should include: 1. Reject absolute paths, path separators, empty identifiers, `.` and `..`. 2. Resolve the reference root and candidate path before checking containment. 3. Validate section identifiers against the trusted index generated at build time. 4. Consider rejecting symbolic links or verifying that the resolved target remains under the reference root. 5. Apply file-size limits before reading content into Agent context. 6. Treat loaded reference content as untrusted data rather than higher-priority instructions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: modules/loading-patterns.md:357

Finding

Unvalidated Module Name Allows Path Traversal in Generic Module Loader

Content

View full analysis

Remediation

View remediation

Path: if module_name not in self.available_modules: raise ModuleLoadError(f"Unknown module: {module_name}") path = (self.module_root / f"{module_name}.md").resolve() if not path.is_relative_to(self.module_root): raise ModuleLoadError("Module path escapes the approved root") if not path.is_file(): raise ModuleLoadError(f"Module file is unavailable: {module_name}") return path ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · modules/git-patterns.md (reported line 119)May include surrounding context.

md

3. **Using `-A` or `.` for staging**: `git add -A` and `git add
   .` capture untracked files that may include secrets or
   build artifacts. Stage explicit paths.
4. **Treating force-push as safe**: `git push --force` rewrites
   shared history. The mutation module should document
   `--force-with-lease` as the default, not `--force`.
5. **Reading raw plumbing output as content**: `git cat-file`

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list uses highly generic phrases such as context-management, modularity, token-optimization, and lazy-loading, which can cause the skill to activate for many unrelated requests. Over-broad activation increases the chance this skill is loaded when not needed, expanding the model's instruction surface and potentially interfering with more relevant skills or causing unintended behavior in user sessions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The section frames this module as guidance for Python 3.8 through 3.10, but the example at L28-L41 unconditionally imports tomllib, which is unavailable before Python 3.11. The surrounding text then immediately says legacy projects should replace tomllib with tomli, so the example actively conflicts with the documented legacy-safe intent rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file defines module trigger metadata using very generic keywords like "git", "commit", and "branch" plus broad artifact matching such as ".git/". It does not provide negative examples or clear constraints, so these triggers could overlap with common discussion and cause unintended module activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The integration examples use broad natural-language triggers such as "branch mentions", "markdown files", "meeting notes", and "time-series data" without specifying thresholds, scope, or non-trigger cases. In a markdown skill description, this can make module loading decisions unclear and prone to accidental invocation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · modules/macos-patterns.md (reported line 78)May include surrounding context.

launchd Service Pattern

Long-running services on macOS use launchd instead of systemd. The launchd sub-module documents the plist format.

xml

<?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · modules/macos-patterns.md (reported line 82)May include surrounding context.

launchd Service Pattern

Long-running services on macOS use launchd instead of systemd. The launchd sub-module documents the plist format.

xml

<?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · modules/macos-patterns.md (reported line 84)May include surrounding context.

launchd Service Pattern

Long-running services on macOS use launchd instead of systemd. The launchd sub-module documents the plist format.

xml

<?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · modules/macos-patterns.md (reported line 95)May include surrounding context.

launchd Service Pattern

Long-running services on macOS use launchd instead of systemd. The launchd sub-module documents the plist format.

xml

<?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · modules/macos-patterns.md (reported line 134)May include surrounding context.

launchd Service Pattern

Long-running services on macOS use launchd instead of systemd. The launchd sub-module documents the plist format.

xml

<?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · modules/macos-patterns.md (reported line 82)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · modules/macos-patterns.md (reported line 100)May include surrounding context.

md

User-scoped agents go in `~/Library/LaunchAgents/`. System-scoped
daemons go in `/Library/LaunchDaemons/` and require root. Load
with `launchctl load -w <path>`, unload with `launchctl unload`.

## Homebrew Detection

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented trigger pattern includes generic question forms like 'How do I...', 'Show me...', and 'Analyze...', which are common across many unrelated conversations. In a progressive-loading skill, such broad selectors can cause incorrect module activation, unnecessary context expansion, and increased exposure to unintended module content or behaviors, especially when combined with automatic loading logic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module describes persistent telemetry across activations by storing module hit history in a file and using it to influence future behavior, but it does not warn users or implement privacy boundaries around that persistence. While the data shown is limited to module names rather than obvious sensitive content, cross-session behavioral storage can still create transparency and privacy issues, especially if users do not expect session-derived state to persist.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.