Security audit

Pine Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned with Pine, but it grants broad authority to inspect task history and start real-world actions, so users should review it carefully before installing.

Install only if you are comfortable letting Pine receive task details and potentially act on your behalf through calls, emails, browser automation, and account workflows. Before use, prefer explicit confirmation before creating sessions, sending sensitive account data, starting tasks, using background polling, or deleting sessions, and consider pinning or otherwise verifying the pineai-cli package.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:5
Finding: Unpinned Third-Party CLI Dependency Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:15
Finding: Overbroad Mandatory Instructions Delegate Agent Decisions and Session Data to an External Service
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The mandatory session lookup trigger is overly expansive, telling the agent to query all active sessions whenever the user mentions almost anything that could relate to a Pine task. This can unnecessarily expose prior task metadata across unrelated conversations and encourages cross-session context retrieval even when the user has not clearly asked to access an existing task.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill treats session history as a persistent memory source and forbids the agent from saying it lacks context, pushing it to consult prior sessions before many actions. This increases the chance of inappropriate reuse of historical task data, confusion between separate user matters, and disclosure of sensitive prior-session information not needed for the current request.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
- The user mentions anything that could relate to a Pine task (a company name, account, refund, call, booking, etc.) - The user asks you to do something that Pine could handle — check if a session already exists - The user asks about progress, status, or follow-up on any task - You are about to create a new session — verify no existing session covers the same task **NEVER do any of these without listing sessions first:** - Say "I don't have context about that" or "Can you remind me?"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill encourages invoking Pine for a very broad class of requests, including ordinary search, discovery, outreach, and online tasks, with guidance to 'let Pine decide' rather than requiring clear user intent. In a terminal agent context, that can cause over-triggering of an external action-taking service and unintended disclosure of user data or initiation of real-world actions when the user may only be asking informational questions.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 81% confidence
Finding: The instruction to respond to Pine and start tasks 'without asking user' after payment/no-payment states authorizes an external service to begin acting autonomously. Even if billing is settled, task execution can trigger calls, emails, browser automation, or account actions that the user may expect to explicitly approve at the final handoff.
Content: Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.
md
- Pine asks for scheduling confirmation — the user must be available - Pine asks for any information you were not given by the user ### RESPOND to Pine (without asking user) when: - Payment confirmed or no payment needed → run `pine task start SESSION_ID` - Task auto-started → just tell the user the task has started (do NOT run task start) - Task finished → share results with the user

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill exposes session deletion commands, including forced deletion, without warning about irreversibility, audit loss, or the need for explicit user confirmation. In an agentic environment, destructive commands documented as routine capabilities can be invoked carelessly and permanently remove task history needed for recovery, compliance, or dispute resolution.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.