Security audit

next-step-tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent and disclosed; install it only if customer call excerpts are allowed in the chosen internal Slack channel.

Before installing, confirm the selected Slack channel is internal and appropriate for customer call quotes, verify the bot is only invited there, review cargo-ai cdk plan, and keep the evidence models read-only. Teams using a CRM should map it as read-only evidence rather than adding CRM write actions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is for a call-commitment tracker workflow. The supplied code chunk only declares a reusable native accounts model (gtm_accounts) and comments about possible CRM substitution. This is at most a supporting data model for account ownership/grouping, but by itself it does not carry out the described core behavior. Because the actual code’s primary purpose in this chunk is account-model definition rather than commitment extraction and reminder handling, the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is for an end-to-end commitment tracker that reads call logs, extracts promises, tracks status, and alerts in Slack. The supplied code only defines a generic gtm_activities data model schema for storing activities such as calls, emails, notes, and tasks. While such a model could support the described system, this chunk itself does not perform the described behavior and instead has a materially different primary purpose: schema/model definition for activity storage.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · evals/contract.mjs (reported line 94)May include surrounding context.
js
"the tracker must have one cron trigger", ); const env = agent.spec.repository?.env ?? []; const envKeys = new Set((Array.isArray(env) ? env : []).map((entry) => entry.key)); assert.equal( envKeys.has("TRACKER_TIMEZONE"),

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
md
**Derive before you ask.** An input with a lookup is looked up, not asked. Only the ones marked _asked_ genuinely live in the operator's head. | Input | Kind | How it is answered | Why it matters | | --------------------------------------------------------- | ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | repository binding (`infra/agents/tracker.ts`) | value | **derived**: leave `repository`, `defaultBranch` and `connector` unset; plan fills them from the checkout's git origin. `cargo-ai cdk check` prints what it resolved. | It is the only place the call log is read from. A hand-written `owner/name` is the value nobody notices is wrong until every morning comes back empty. | | call log path | value | **derived**: `ls cadence/log/calls/` and read two entries. The prompt expects call-capture's shape: frontmatter with a date, and an Actions section of checkboxes. | A log in another folder or shape is read as empty, and an empty morning looks exactly like a team that kept every promise. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
md
**Derive before you ask.** An input with a lookup is looked up, not asked. Only the ones marked _asked_ genuinely live in the operator's head. | Input | Kind | How it is answered | Why it matters | | --------------------------------------------------------- | ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | repository binding (`infra/agents/tracker.ts`) | value | **derived**: leave `repository`, `defaultBranch` and `connector` unset; plan fills them from the checkout's git origin. `cargo-ai cdk check` prints what it resolved. | It is the only place the call log is read from. A hand-written `owner/name` is the value nobody notices is wrong until every morning comes back empty. | | call log path | value | **derived**: `ls cadence/log/calls/` and read two entries. The prompt expects call-capture's shape: frontmatter with a date, and an Actions section of checkboxes. | A log in another folder or shape is read as empty, and an empty morning looks exactly like a team that kept every promise. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.
md
## What you can change | Variation | When it is right | How | What it costs | | ----------------- | --------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | `ours-only` | The team only wants to see what it promised | In §1 of `infra/agents/tracker.prompt.ts`, record only commitments with `promised_by` "us" | A customer's "legal will review by Friday" is the commitment most often lost, and it is the one a rep has to chase. Dropping it hides stalled deals. | | `default-windows` | Your team's follow-up rhythm is not seven days for us, fourteen for them | Change the two fallbacks in §1 of the prompt | Only promises with no date said on the call use them. Too short and the post fills with things that were never late. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.
md
## What you can change | Variation | When it is right | How | What it costs | | ----------------- | --------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | `ours-only` | The team only wants to see what it promised | In §1 of `infra/agents/tracker.prompt.ts`, record only commitments with `promised_by` "us" | A customer's "legal will review by Friday" is the commitment most often lost, and it is the one a rep has to chase. Dropping it hides stalled deals. | | `default-windows` | Your team's follow-up rhythm is not seven days for us, fourteen for them | Change the two fallbacks in §1 of the prompt | Only promises with no date said on the call use them. Too short and the post fills with things that were never late. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
| Variation | When it is right | How | What it costs | | ----------------- | --------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | `ours-only` | The team only wants to see what it promised | In §1 of `infra/agents/tracker.prompt.ts`, record only commitments with `promised_by` "us" | A customer's "legal will review by Friday" is the commitment most often lost, and it is the one a rep has to chase. Dropping it hides stalled deals. | | `default-windows` | Your team's follow-up rhythm is not seven days for us, fourteen for them | Change the two fallbacks in §1 of the prompt | Only promises with no date said on the call use them. Too short and the post fills with things that were never late. | | `quiet-day-line` | Silence on a clear day reads as a missed run | In §3 of the prompt, post one "Nothing due today" line instead of nothing | One more message a day in the channel. The default is silence because a nudge channel nobody needs to read is the one that gets muted. | | `per-rep-dm` | Each rep wants their own list | One `postMessage` use per rep with its channel ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
md
| `quiet-day-line` | Silence on a clear day reads as a missed run | In §3 of the prompt, post one "Nothing due today" line instead of nothing | One more message a day in the channel. The default is silence because a nudge channel nobody needs to read is the one that gets muted. | | `per-rep-dm` | Each rep wants their own list | One `postMessage` use per rep with its channel locked, and a map from owner to use in §3 | Every rep added is a deploy. Never unlock the channel to let the agent find a DM itself. | | `crm-backed` | The emails, meetings, notes and tasks already live in HubSpot, Salesforce or Attio | Replace `infra/models/gtm-activities.ts` and `gtm-accounts.ts` with connector-backed models (`fetchRecords`, every column, scheduled sync) of the CRM's engagements and companies, keep the slugs, and map the CRM's columns onto `account_id`, `opportunity_id`, `contact_id`, `occurred_at`, `kind`, `subject`, `body` and `owner_email` in the prompt's §2 query. Keep both read-only on `uses` | One more connector and a sync on a schedule. Evidence is as fresh as the last sync, so schedule it before the tracker's cron or a promise kept yesterday afternoon is nudged this morning. Never add CRM actions to the agent instead | | `reach-back` | The log has more than 30 days of open promises worth chasing | Widen the window in §1 | Backfilled promises arrive overdue all at once. Prefer letting call-capture's STALE-CHECK prefix keep old ones out. | ## What should not change

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This code describes that a nudge quotes what a customer said on a call and sends it to Slack, which is a network transmission of potentially sensitive user/customer data. While the skill description says it posts due or overdue items to Slack, it does not clearly warn that quoted call content will be transmitted to Slack or disclose the privacy impact.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.