T08 · Insecure Dependencies
Warning
- Location
README.md:30- Finding
Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Agent Productivity Tools
Security checks for vulnerabilities and agentic risk
Overview
This is a documentation-only productivity setup skill, but it guides agents toward installing and authenticating multiple unpinned third-party tools that may access sensitive Google Workspace and Notion data.
Install only after reviewing each dependency's publisher, version, requested permissions, and OAuth/API scopes. Prefer pinned or verified releases, grant least-privilege/read-only access first, and avoid implementing the context.jsonl sample with secrets or sensitive business content unless you add access controls, retention, and redaction.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
PA_GUIDE.md:85- Finding
Assistant Context Is Persisted in an Unprotected Plaintext File
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 55% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - Provide the rationale in one sentence. - Define the decision boundary. - Offer a narrow path to continue the conversation if needed. - Do not apologize for enforcing a boundary. - Do not ask open-ended questions. ## Example
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 55% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - Provide the rationale in one sentence. - Define the decision boundary. - Offer a narrow path to continue the conversation if needed. - Do not apologize for enforcing a boundary. - Do not ask open-ended questions. ## Example
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The guide advises persisting assistant context to a local JSONL file containing recent decisions, active projects, and user preferences, but gives no guidance on data minimization, access controls, retention, encryption, or avoiding secrets/PII. In a personal-assistant context, that store is likely to accumulate sensitive business and personal information, creating confidentiality and compliance risk if the file is exposed, synced insecurely, or reused unsafely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The suggested invocation phrases are broad and action-oriented, especially 'Set up my productivity tools', which could plausibly match ordinary user requests and cause this skill to activate when the user did not explicitly intend to use it. Because the skill claims the agent will handle installation, configuration, and authentication, an overbroad trigger increases the chance of unintended privileged actions or credential-related setup flows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises that the agent will perform installation, configuration, and authentication, but it does not warn users that these actions may involve account access, system changes, package installs, or security-sensitive prompts. In this context, missing disclosure is risky because users may consent to broad setup assistance without realizing the scope of privileged operations the agent may attempt.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The note says "CLI commands exist as see README" but does not define what commands invoke the skill, when they should be used, or any constraints/exclusions. In a manifest file, this kind of vague activation guidance can lead to unintended or overly broad invocation because there is no explicit trigger list or negative examples.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md - Do not ask open-ended questions. ## Example > We cannot extend the scope for this sprint. The team is already at capacity and adding features now would jeopardize the release date. I can slot this for Sprint 14 if you can confirm priority by Friday. Otherwise we'll revisit in planning.
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md - Do not ask open-ended questions. ## Example > We cannot extend the scope for this sprint. The team is already at capacity and adding features now would jeopardize the release date. I can slot this for Sprint 14 if you can confirm priority by Friday. Otherwise we'll revisit in planning.