digital-employee-onboarding

• Outcome: Pass
• Latest audit: Nov 6, 2026 · 4:22 AM UTC
• Version: 1.0.0

Overview

The skill describes a controlled agent setup with disclosed credentials, backups, and persistent services, though supporting installation materials are missing.

Expect changes to machine configuration, persistent services, and automated repository backups. Review the backup file allowlist, destination, permissions, and timer before activation. Obtain the missing baseline document and inspect the exact dependent skill releases; their implementations were not available for this review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

tra service principal for the employee and grant it least-privilege access to the approved Azure DevOps repository. Use the service principal to obtain short-lived tokens for the deterministic backup runner; use a PAT only as Daniel's explicit recorded exception. Keep tenant and application identifiers in the host manifest and client credentials in protected local secret storage.
6. Create a separate backup contract with an allowlisted, source-controlled runner; a local ledger; workspace-backed systemd units; and a failure-only notification contract. Prove service-principal login with `--allow-no-subscriptions`, read access to the approved remote, a dry-run, one real commit/push, notification dry-run, unit validation, service execution, and an enabled six-hour timer. Never inherit another employee’s backup credentials, service names, or failure target.
7. Inventory all source automations before cutover. Migrate one job at a time using its file-backed manifest and fresh runtime; prove n