Security audit

sunsama

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Sunsama/Maton integration for managing tasks, calendar items, timers, and connected email threads, with meaningful approval guidance for writes.

Install only if you are comfortable letting Maton act on your Sunsama account and any linked email/calendar data. Review connection scopes, require explicit approval before writes or deletes, avoid raw API keys when the CLI/OAuth flow is available, and be especially careful with persistent functions, triggers, and destinations.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema enables creation of a new channel/context, but the surrounding skill description emphasizes Sunsama task, calendar, backlog, objectives, time tracking, and email-thread operations and does not clearly establish channel creation as an allowed capability. This creates scope drift: an agent could invoke a write-side action not clearly disclosed to the user, increasing the risk of unauthorized or surprising state changes in the user's workspace.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The schema exposes a write action to schedule an 'accountability call' on the user's calendar, but that operation is not clearly described in the stated Sunsama capabilities. This capability mismatch can mislead downstream agents or users into invoking an unintended side-effecting action, increasing the risk of unauthorized or deceptive calendar modifications under the user's authenticated connection.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON manifest uses a very generic description, "Append notes to a task," without any scope, trigger examples, or exclusion conditions. In a manifest file, such broad wording can ambiguously match common task-management requests and make it unclear when this skill should activate versus other similar skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This JSON schema is a manifest-type file, so vague-trigger checks apply. The description "Create a calendar event" is very generic and does not specify when this skill should activate, what phrases should invoke it, or any exclusions, which could lead to overly broad matching against common user requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This manifest-style JSON describes the skill only as "Create a new channel/context for tasks," which is a broad capability description without any explicit trigger phrases, scope limits, or exclusion conditions. In a manifest file, that lack of specificity can contribute to ambiguous or overly broad activation decisions.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description "List all tasks in the backlog" describes a generic action that could overlap with common task-management requests, but it does not define specific trigger phrases, scope limits, or exclusion conditions. In a manifest file, this kind of broad natural-language description can make invocation boundaries unclear.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest description says only "Mark a subtask as completed," which is a generic action phrase that could overlap with many ordinary task-management requests. The file does not provide trigger scope, exclusion conditions, or any narrowing context to clarify when this skill should activate versus similar skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This manifest-style JSON file describes the skill only as "Search for tasks by keyword," but does not specify how or when the skill should be invoked, nor any constraints or exclusions. The lack of explicit trigger scope makes activation intent broad and potentially overlapping with common task-related queries.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This is a manifest-style JSON file, so vague-trigger checks apply. The description "Start the timer for a task" is generic and does not specify invocation boundaries, trigger phrases, or exclusions, which could cause the skill to match ordinary task-related requests too broadly.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.