Security audit

dev-inbox

Security checks for vulnerabilities and agentic risk

Overview

This task-triage skill is not malicious, but it can automatically store conversation items in durable places like GitHub, agent memory, or TODO files with limited consent and privacy guardrails.

Install only if you want an agent to persist deferred work automatically. Use it carefully in private or commercial repositories, and avoid invoking it with secrets, credentials, customer data, or sensitive business context unless you first confirm the exact destination and visibility. Prefer requiring confirmation before GitHub issue creation, label creation, memory writes, or TODO.md edits.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The manifest declares only Bash, Read, Write, Grep, and Glob, but the skill explicitly instructs use of the external GitHub CLI (`gh`) to create and modify remote issues and labels. This creates a capability-transparency gap: operators may approve or sandbox the skill based on incomplete metadata while it still drives networked state changes on a remote service.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill includes administrative label-creation commands against GitHub, which go beyond the core purpose of recording inbox items. Unnecessary repository-administration actions expand the blast radius from simple note-taking to modifying shared project metadata, enabling unintended persistent changes in remote infrastructure.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README explicitly says the skill will automatically route session content to GitHub Issues, agent memory, or TODO.md, which implies persistence and possible external transmission of user-provided or inferred content. Without an explicit notice about storage destinations, retention, and consent boundaries, the skill can cause unintentional disclosure of sensitive information or create records the user did not expect.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Stating that the skill 'records after deduplication without asking for confirmation again' normalizes automatic persistence without reaffirming user consent at write time. In a triage skill that may extract unrelated or deferred items from general conversation, this increases the risk that sensitive, mistaken, or contextually private content is stored or transmitted unexpectedly.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list contains broad phrases like "inbox," "log this," and similar natural-language variants that are likely to appear in ordinary conversation. Overbroad activation increases the chance the skill runs unintentionally and performs persistence or remote issue actions on content the user did not mean to route into durable storage.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description says to use the skill whenever a message contains multiple requests, something is unrelated/deferred, or the user asks to remember/track/log something later, which is broad and ambiguous. In context, that ambiguity is risky because the skill is authorized to persist content into durable stores and potentially to remote GitHub resources without a strong boundary on when it should activate.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill is designed to persist deferred work and recovered context across sessions, but it provides no guardrails for secrets, personal data, access tokens, or sensitive business information. This creates a durable data-retention path where sensitive conversational content can be copied into memory systems, TODO files, or GitHub issues and later exposed more broadly than the original session.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The skill treats a natural-language request to "remember," "track," or defer something as blanket consent to persist it automatically, without re-confirmation. That is dangerous because users may casually mention sensitive items, and the skill converts that conversational phrasing into durable storage actions, potentially in shared or remote locations.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The priority order explicitly prefers future-discoverable destinations such as GitHub issues, agent memory, and project TODO files, all of which can outlive the session and may be visible to other tools, collaborators, or future runs. Without content classification or destination restrictions, this systematically increases the exposure of sensitive user-provided context.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: ## Key features - Proactive: agent intervenes when it detects off-task items - Explicit requests: records after deduplication without asking for confirmation again - Proactive inference: proposes title, type, and priority for one-word confirmation - Merge logic: checks for existing related records before creating duplicates - Environment-adaptive: works with or without GitHub, with or without agent memory
Confidence: 82% confidence
Finding: The README endorses autonomous action by having the agent record items 'without asking for confirmation again.' While not inherently malicious, this removes a user checkpoint for actions that can have persistent side effects, making the skill more dangerous because its purpose is to capture and route potentially off-task content automatically.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: 1. Classify the item. 2. Check for an existing related record. 3. Persist or merge it without asking for confirmation again. 4. Report the record location, then return to the active objective. Ask one focused question only when deduplication is genuinely ambiguous.
Confidence: 91% confidence
Finding: The instruction to persist or merge items "without asking" authorizes the agent to make autonomous decisions about durable writes and possible remote mutations. In this skill's context, autonomous action is more dangerous because it is coupled with broad triggers and multiple persistence backends, reducing the opportunity for the user to catch mistakes before data is stored or shared.

Static analysis

No suspicious patterns detected.