the king is watching

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:51 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but its advertised workflow enforcement and verification are unreliable enough that users should review it carefully before use.

Use this only for experiments or tightly controlled local workflows. Do not rely on translate_and_run for real downloads, reports, compliance evidence, or side-effecting automation until real executors, verification, bounded inputs, safe state paths, and true resume semantics are implemented.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

other

Error

• Location: overseer/__init__.py:738

Finding

Generated workflows falsely report successful task completion without executing or verifying the requested work

Content

View full analysis

"Overseer": workflow_def = plan.get("workflow", {}) steps_def = plan.get("steps", []) overseer = cls( name=workflow_def.get("name", "auto_workflow"), description=f"Auto-generated: {workflow_def.get('source_command', '')}", **kwargs ) for step_def in steps_def: step_name = step_def["name"] task_type = step_def.get("task_type", "generic") if task_type == "search_download": func = cls._create_search_download_func(step_def) elif task_type == "write_chapter": func = cls._create_write_func(step_def) else: func = cls._create_generic_func(step_def) decorator = overseer.step( name=step_name, retry=step_def.get("retry", 3), timeout=step_def.get("timeout", 1800), heartbeat_interval=step_def.get("heartbeat_interval", 60) ) decorator(func) return overseer @staticmethod def _create_search_download_func(step_def: Dict) -> Callable: params = step_def.get("params", {}) expected_count = params.get("expected_count", 10) def search_download_func(ctx): # Should integrate actual search download logic # Currently returns mock result ctx.heartbeat(f"Starting download of {expected_count} items...") # Actual execution would call kimi_search and kimi_fetch # result = actual_search_and_download(params) return { "task": step_def["description"], "expected": expected_count, "status": "completed" } return search_download_func @staticmethod def _ ...[truncated 2980 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: overseer/__init__.py:247

Finding

Unsanitized workflow and job identifiers permit state-path traversal

Content

View full analysis

str: """Get state file path""" return os.path.join(self.state_dir, f"{run_id}.json") def get_job_file(self, job_id: str) -> str: """Get job info file path""" return os.path.join(self.state_dir, "jobs", f"{job_id}.json") def save(self, run_id: str, state: Dict) -> None: """Save state""" state_file = self.get_state_file(run_id) with open(state_file, "w", encoding="utf-8") as f: json.dump(state, f, ensure_ascii=False, indent=2) def load(self, run_id: str) -> Optional[Dict]: """Load state""" state_file = self.get_state_file(run_id) if os.path.exists(state_file): with open(state_file, "r", encoding="utf-8") as f: return json.load(f) return None def save_job(self, job: JobInfo) -> None: """Save job info""" job_file = self.get_job_file(job.id) with open(job_file, "w", encoding="utf-8") as f: json.dump(job.to_dict(), f, ensure_ascii=False, indent=2) def load_job(self, job_id: str) -> Optional[JobInfo]: """Load job info""" job_file = self.get_job_file(job_id) if os.path.exists(job_file): with open(job_file, "r", encoding="utf-8") as f: data = json.load(f) return JobInfo(**data) return None ``` Run identifiers also incorporate the workflow name without normalization: ```python def _generate_run_id(self) -> str: timestamp = datetime.now().strftime("%Y%m%d_%H%M%S") return f"{self.name}_{timestamp}_{ ...[truncated 1888 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: overseer/translator.py:258

Finding

Unbounded natural-language quantities can exhaust memory and CPU during plan generation

Content

View full analysis

TaskIntent: command_lower = command.lower() for pattern in self.patterns: for regex in pattern["regexes"]: match = re.search(regex, command_lower, re.IGNORECASE) if match: num_str = match.group(1) if pattern.get("unit") == "words" and len(match.groups()) > 1: multiplier = match.group(2) if multiplier in ("k", "thousand"): num = int(num_str) * 1000 else: num = int(num_str) else: num = int(num_str) return TaskIntent( name=pattern["name"], task_type=pattern["task_type"], total_units=num, unit_name=pattern.get("unit", "items"), parameters=pattern.get("parameters", {}), confidence=0.9 ) numbers = re.findall(r'\d+', command_lower) if numbers: total = max([int(n) for n in numbers]) else: total = 10 return TaskIntent( name="generic_batch", task_type="search_download", total_units=total, unit_name="items", parameters={}, confidence=0.5 ) def _calculate_chunks(self, intent: TaskIntent, capacity: Dict) -> List[TaskChunk]: max_per_chunk = capacity["max_items"] total = intent.total_units chunks = [] num_chunks = math.ceil(total / max_per_chunk) for i in range(num_chunks): start = i * max_per_chunk + 1 end = min((i + 1) * max_per_chunk, total) chunk = TaskChunk( index=i, start=start, end=end, ...[truncated 1916 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: overseer/reporter.py:55

Finding

Zero-second progress intervals create a busy reporting loop

Content

View full analysis

None: """Background report loop""" while not self._stop_event.is_set(): if self._stop_event.wait(self.interval): break self._do_report() ``` ### Technical Analysis Neither direct `interval_seconds` values nor parsed natural-language values are required to be positive. Inputs such as `interval_seconds=0` or `interval_desc="every 0 seconds"` produce an interval of zero. `threading.Event.wait(0)` returns immediately. The background thread therefore enters a tight loop and repeatedly calls the report callback. The default callback prints a multi-line report every iteration, potentially consuming a CPU core and rapidly filling captured logs, terminal buffers, or disk-backed logging systems. Negative direct intervals can also raise runtime errors in the reporter thread rather than being rejected during configuration. ### Attack Path 1. An application permits a user or agent to select `report_interval`. 2. The attacker supplies `Every 0 seconds`, or code passes `interval_seconds=0`. 3. `_parse_interval( ...[truncated 464 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This code chunk does not substantively implement the declared workflow-enforcement behavior; it is a demonstration script that prints feature descriptions and simulates progress. The only dynamic behavior is a for-loop with sleep and periodic progress messages. Although it imports translate_and_run and Overseer, it does not use them meaningfully; the relevant execution call is commented out. As a result, the actual behavior of the provided chunk is materially different from the declared purpose: instead of enforcing auditable AI workflows with persistence, heartbeat, verification, and translation, it mainly presents a mock demo of those ideas. Additionally, the demo mentions async/background execution, which is not part of the declared capabilities. Therefore this chunk is mismatched relative to the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description presents a full workflow enforcement system with multiple runtime control features. The provided code chunk, however, is a demonstration harness focused on task translation and display of generated plans. It exercises natural language task translation/auto-chunking and surfaces verification metadata, but there is no implementation here of execution control, anti-skipping enforcement, checkpoint persistence/resume, heartbeat/timeout prevention, or interval-based progress reporting. Because the code’s actual behavior is much narrower than the declared capabilities and its primary purpose in this chunk is demoing task splitting rather than enforcing workflows, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad 'AI Workflow Enforcer' with multiple control and enforcement features. The supplied code chunk is narrowly a reporter module (overseer/reporter.py) whose primary function is timed progress output. It supports one declared area well: progress reporting with natural language intervals. It also tracks step statuses and emits reports on completion, but this is reporting state, not enforcement or verification. There is no code for checkpoint persistence, resume, mandatory sequential execution, task translation/chunking, or substantive heartbeat/timeout prevention logic. Therefore the description materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad AI workflow enforcement system with execution-control features. However, this code chunk only covers the translator/planner portion: parsing simple natural-language commands, identifying an intent via regex, chunking tasks by configured capacity, and emitting a plan structure with verification and timing fields. While the generated plan includes fields like verification, retry, timeout, and heartbeat_interval, there is no runtime logic here to enforce sequential execution, verify completed work, persist state, resume from checkpoints, send heartbeats, or produce progress updates. So the description overstates the implemented behavior for this supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code chunk does not appear malicious, but it does not fully match the declared description. The main purpose is close—workflow orchestration/testing with sequential execution, heartbeat, and resume—but this specific code is a test harness rather than the enforcement tool itself. It validates several declared features: strict order, heartbeat, checkpoint/resume, and progress reporting. However, it also tests an undeclared capability: asynchronous execution (async_mode, run_async, check_status, job IDs, completion notification). Conversely, one of the declared headline features—natural language task translation with auto-chunking—is not represented anywhere in the provided code. Because the evaluation standard says to flag undeclared capabilities and materially different behavior, this is a mismatch, though only a partial one since much of the described functionality is aligned.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The advertised checkpoint resume capability is broken because resume() restores state but then calls run(), which generates a new run_id, reinitializes context, resets current_step_index to 0, and re-executes from the beginning. In a workflow-enforcement skill, this can cause duplicate execution of side-effecting steps, undermine auditability, and mislead operators into believing partially completed work is safely resumed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstrings and user-facing behavior promise continuation from a saved checkpoint, but the implementation effectively restarts the workflow. That mismatch is dangerous because users may rely on resume for long-running or destructive operations, leading to repeated downloads, repeated writes, duplicated external actions, or corrupted workflow state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file title and the entire document are written in Chinese, which indicates a fixed language choice for the skill-related documentation. There is no visible note offering alternative language support or explaining that the skill is intentionally region-specific, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The installation guide promotes asynchronous background execution with notify_on_complete=True and notify_channel="discord" but gives no warning that notifications may transmit task metadata, status, or results to external services. In an agent setting, this can lead to unintended data disclosure or side effects because users may copy the example without understanding that execution continues after the initiating session and may send information off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The one-liner translate_and_run("Download 100 photochemistry research reports") implies autonomous network retrieval and processing of external content without warning about network access, source trust, rate limits, copyright/licensing, or data handling. In a workflow-enforcement skill, this is more dangerous because the tool's purpose is to compel execution, increasing the chance that an agent will carry out broad external actions automatically once prompted.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · INSTALL.md (reported line 222)May include surrounding context.

result = translate_and_run("Download 100 photochemistry research reports")

Auto splits into 10 steps, each verified

No cutting corners possible

text

## Installation

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

result = translate_and_run("Download 100 photochemistry research reports")

Auto splits into 10 steps, each verified

No cutting corners possible

text

## Installation

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The release plan explicitly states that the package contents are 'all in English,' which imposes a language constraint in natural language. Because the document does not offer users a language choice or explain a necessary region-specific justification, this conflicts with the policy against forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The checklist item 'All documentation in English' codifies a fixed language requirement. This is a natural-language locale policy constraint and no user choice, opt-in, or business/regulatory justification is provided in the file.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises and demonstrates capabilities that imply network access, file handling, and background execution, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, this increases the chance of over-privileged execution and makes it harder for hosts to constrain risky actions such as bulk downloads, file writes, and external notifications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples encourage broad natural-language commands such as 'Download 100 reports' without scope limits, source restrictions, legality constraints, or data sensitivity checks. In an autonomous or semi-autonomous agent, this can trigger excessive network activity, collection of unintended content, or interaction with untrusted sources because the command boundary is underspecified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation promotes downloading, background execution, and external notifications but does not disclose the security and privacy consequences of those operations. That omission can lead users to enable persistent jobs, outbound network access, or messaging integrations without understanding data exfiltration, resource consumption, or side effects on host systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents notify_on_complete=True and notify_channel="discord", which implies sending task completion information to an external service. The user guide does not warn that task metadata or status may be transmitted off-system, which is a relevant privacy and disclosure concern for a skill description.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · examples/demo_v040_full.py (reported line 84)May include surrounding context.

python

print("  - Companies: 20 reports")
    print("  - Cross-field: 20 reports")
    print()
    print("✅ Each Step verified, no cutting corners")
    print("✅ Full execution trace saved")

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The demo asserts that a full execution trace was saved even though no trace, checkpoint, or persistence logic is present. In a workflow-enforcement skill, this is security-relevant because users may rely on nonexistent auditability and assume actions were recorded for review, compliance, or recovery when they were not.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The feature list claims async/background execution with completion notification, but the script performs only synchronous console output. This can mislead operators into believing long-running tasks are safely detached and monitored, increasing the risk of missed failures, blocked sessions, or incorrect operational assumptions.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · examples/test_multi_scenarios.py (reported line 54)May include surrounding context.

python

scenarios = [
        ("Download Reports", "Download 100 industry research reports"),
        ("Write Report", "Write 50000 words industry analysis report"),
        ("Analyze Data", "Analyze 1000 user feedback entries"),
        ("API Calls", "Call API 500 times to fetch data"),
        ("Process Files", "Process 200 PDF files"),

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module and class documentation repeatedly advertise forced sequential execution with 'no step skipping'. However, the Step model supports a condition callback, and _execute_step explicitly marks steps as 'skipped' when the condition is false. That is a semantic mismatch between the stated guarantee and actual behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Workflow state, context data, and job metadata are written in plaintext JSON under a local .overseer directory without any disclosure, minimization, or protection controls. Because this skill is designed for long-running auditable workflows and may process arbitrary task inputs, persisted state can easily contain sensitive prompts, credentials, intermediate results, or business data that become exposed to other local users, backup systems, or unintended archives.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The translator turns free-form natural-language commands directly into structured execution plans for impactful operations such as downloads, API batches, and file processing, but it provides no safety gating, risk classification, confirmation requirement, or policy validation before plan generation. In an agentic workflow context, this increases the chance that ambiguous, harmful, or socially engineered input is normalized into an executable plan and later executed by downstream components without adequate human review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.