T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:153- Finding
Unbounded monitoring of team-member activity through privileged workspace state
- Content
View full analysis
- Remediation
View remediation
Security audit
Hogwarts Magical Claw for Research Laboratory
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent team-collaboration assistant, but it also directs recurring member monitoring, repository writes, commits, pushes, and scheduled execution without enough consent and approval controls.
Install only for a team that explicitly wants AI-assisted project tracking and has agreed to member activity processing. Before enabling it, keep heartbeat monitoring and scheduled execution off by default, require human review before Git commit or push, limit readable member files, and document how members can opt out or disable reminders.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/protocol.md:32- Finding
Centralized profiling and remote synchronization of member-derived metadata
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Warning
- Location
references/protocol.md:336- Finding
Persistent scheduled execution without lifecycle or least-privilege controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description says the skill triggers whenever knowledge management, progress monitoring, or document collaboration is needed, which is overly broad and lacks enforceable boundaries. Because the skill also reads files, updates records, pings members, and can commit to Git, this ambiguity increases the chance of unintended activation and unauthorized workflow actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The meeting trigger list includes broad colloquial phrases like '讨论一下', '碰一下', and '拉通', which can cause the skill to activate in ordinary conversation without clear user intent. In a collaboration agent with authority to drive workflows, mention users, and initiate follow-up behavior, over-triggering can lead to unnecessary monitoring-style interactions and unintended operational actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The HEARTBEAT workflow instructs the agent to periodically read and update member communication logs and proactively contact members who have not interacted recently, but it does not require transparent notice or consent. This creates a surveillance-like behavior pattern and enables persistent tracking of individuals' activity, which is especially sensitive in a team collaboration context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill includes automatic Git add/commit commands affecting member task logs and knowledge-base content without requiring an approval checkpoint or warning about repository writes. In practice, this can create unauthorized or accidental modifications, commit sensitive internal information, and leave an audit trail of AI-generated changes that users did not explicitly approve.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill directs the agent to automatically generate and update files in the repository during initialization and ongoing operation, but does not prominently warn users that invoking the skill can change repository contents. In a collaboration repository, silent writes can alter planning documents, knowledge bases, and task records in ways users may not expect or immediately review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The protocol includes automatic git add/commit/push behavior, which can publish repository changes to a remote branch without a clear, explicit warning or approval step. In practice, this can propagate incorrect content, sensitive information, or prompt-influenced edits beyond the local workspace, making rollback and containment harder.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The protocol explicitly tells the agent to set up cron or calendar-based triggers so it can act proactively without a fresh user request. That expands the skill from a reactive collaboration helper into a semi-autonomous actor, increasing the chance of unsupervised repository reads/writes, notifications, and other side effects beyond the user's immediate intent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
文件的名称与描述整体以中文定义助手职责和输出模式，未见提供可选语言、用户偏好继承或显式 opt-in。根据规则，若技能强制特定语言而无用户选择，属于自然语言层面的语言/locale 策略问题。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The skill title and entire protocol are written as a Chinese-only operating specification, and no section offers users a language or locale choice. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale limitation is explicitly justified.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
L021 states that all operations must be traceable through Git commits, implying a fully repository-auditable workflow. However, later lines direct the assistant to send summaries and urgent notifications in team chat channels, which contradicts that absolute traceability claim because those actions occur outside Git history.
- Content