Security audit

Campaign Tracker

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it processes email/customer data and has under-scoped local writes that users should review before installing.

Review this skill before installing. Use it only with a dedicated, least-privileged mailbox/export directory and a private output location. Prefer dry-run first, set OBSIDIAN_VAULT deliberately, avoid shared machines, and validate campaign IDs/report filenames before processing untrusted email-derived data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/archive-sent-records.js:291
Finding: Path Traversal in Campaign and Report File Handling
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/archive-sent-records.js:34
Finding: Predictable Shared Temporary State Files Permit Symlink and State-Tampering Attacks
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (42)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This second mismatch finding highlights undeclared capability creep: the skill appears to read inbox/captured mail, classify replies, update funnel status, and write back archives, none of which are fully and clearly represented by the top-level declaration. Misleading capability disclosure is dangerous because it obscures sensitive mailbox processing and persistent state changes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This second mismatch finding highlights undeclared capability creep: the skill appears to read inbox/captured mail, classify replies, update funnel status, and write back archives, none of which are fully and clearly represented by the top-level declaration. Misleading capability disclosure is dangerous because it obscures sensitive mailbox processing and persistent state changes.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
node scripts/archive-sent-records.js check --dry-run # 预览

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
node scripts/archive-sent-records.js check --dry-run # 预览

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
md
node scripts/archive-sent-records.js check --dry-run # 预览

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
node scripts/reply-matcher.js check --dry-run # 预览

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
node scripts/reply-matcher.js check --dry-run # 预览

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
node scripts/reply-matcher.js check --dry-run # 预览

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
md
node scripts/reply-matcher.js check --dry-run # 预览

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
node scripts/analytics-report.js weekly

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
node scripts/analytics-report.js weekly

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
node scripts/analytics-report.js weekly

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
node scripts/analytics-report.js weekly

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
node scripts/analytics-report.js weekly

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
node scripts/template-optimizer.js analyze --dry-run # 预览

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
node scripts/template-optimizer.js analyze --dry-run # 预览

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
node scripts/template-optimizer.js analyze --dry-run # 预览

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
node scripts/template-optimizer.js analyze --dry-run # 预览

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The documented pattern require(process.env.EMAIL_SKILL_ROOT + '/.env') implies loading a .env file as code/config from a path controlled by an environment variable. This is dangerous because it can expose credentials from another skill's configuration and, depending on runtime/module handling or surrounding code, may allow unintended file loading from attacker-influenced paths.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
const emailSkillPath = process.env.EMAIL_SKILL_ROOT || '<path-to-imap-smtp-email>'; // reply-matcher.js 使用 IMAP 收件箱 const imapConfig = require(process.env.EMAIL_SKILL_ROOT + '/.env'); // 客户匹配使用 OKKI 向量搜索 const vectorSearch = process.env.OKKI_VECTOR_SEARCH || '<path-to-okki_vector_search_v3.py>';

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README describes automated inbox checking, reply matching, local archival, analytics generation, and output to an Obsidian vault, but it does not disclose privacy, consent, retention, or sensitive-data handling expectations. Because this skill processes email content and customer reply data, users may enable it without understanding that personal or confidential information will be copied into local JSONL files and knowledge-base directories, increasing the risk of unintended disclosure or over-collection.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill documents access to environment variables and external paths but does not declare an explicit tool scope such as allowed tools or permissions. This creates an authorization and transparency gap: a user may invoke a skill that reads sensitive environment-derived configuration without a clear upfront boundary on what resources it is expected to access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The workflow depends on IMAP mailbox access and sent-mail logs, but the documentation does not explicitly warn users that mailbox contents and metadata will be processed. Because email data often contains sensitive personal or business information, omission of this privacy-impact disclosure can cause unintentional overexposure of user data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill notes output locations, but it does not provide an explicit warning that execution creates directories and writes tracking data, reports, and optional Obsidian content to local storage. This can lead to silent persistence of potentially sensitive customer and email metadata, which is especially risky in shared workstations or synced vaults.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This JSON schema uses Chinese natural-language descriptions throughout, but the file does not document that the skill is intentionally region-specific or provide any language choice. Under the policy, a skill that forces a specific language or locale without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all user-facing report content in Chinese, and there is no indication that the language was selected by the user or that the report is intended only for a Chinese-speaking audience. The stated policy forbids forcing a specific language or locale without user opt-in or a documented justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.