Security audit

Runtime Instructions Control Plane

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it lets a Google Sheet persistently steer agent instructions and can bulk-change cron job state with weak safeguards.

Install only in environments where the Google Sheet is tightly access-controlled and treated as an operational authority. Use least-privilege read-only service-account credentials, keep the private key in a secret manager, review dry-run output before any --apply, and avoid applying reconciliation until missing rows no longer disable jobs unintentionally. Periodically inspect or clear cached runtime-instruction files if sheet content changes or may contain sensitive instructions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: scripts/load-sheet-instructions.mjs:128
Finding: Untrusted Google Sheet Content Becomes Persistent High-Priority Agent Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/reconcile-cron-from-sheet.mjs:95
Finding: Incomplete Sheet Data Can Disable Unrelated Cron Jobs
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
- `scripts/load-sheet-instructions.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
- `scripts/load-sheet-instructions.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
- `scripts/load-sheet-instructions.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
md
- `scripts/reconcile-cron-from-sheet.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
- `scripts/reconcile-cron-from-sheet.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
- `scripts/reconcile-cron-from-sheet.mjs`

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill describes scripts that use environment variables for credentials and access Google Sheets over the network, but the manifest does not declare any explicit tool scope or permissions boundaries. This creates a control-plane blind spot: operators may invoke a skill with broader capabilities than intended, increasing the risk of unintended secret exposure, unauthorized network access, or misuse of external configuration to alter local job behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file explicitly instructs users to provide GOOGLE_SERVICE_ACCOUNT_PRIVATE_KEY, which is a highly sensitive credential, but it does not include any warning about secure storage, exposure risk, or avoiding logging/sharing the value. For markdown files, omissions of warnings about privacy or system-sensitive behaviors are in scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The script accesses service-account credentials from environment variables, including a private key, but provides no nearby comment, docstring, or user-facing disclosure that sensitive credentials will be consumed for authentication. Under the rule, access to sensitive environment variables should have some form of disclosure unless already clearly documented elsewhere in-scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The script persists fetched sheet data to JSON and Markdown files under the runtime state directory, but there is no prior warning, confirmation, or descriptive comment/docstring near the write operations explaining that local files will be created or overwritten. Although the script logs output paths after success, that disclosure happens only after the write has already occurred.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/load-sheet-instructions.mjs (reported line 67)May include surrounding context.
js
const signature = signer.sign(privateKey); const assertion = `${signingInput}.${b64url(signature)}`; const resp = await fetch('https://oauth2.googleapis.com/token', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/reconcile-cron-from-sheet.mjs (reported line 50)May include surrounding context.
js
const signature = signer.sign(privateKey); const assertion = `${signingInput}.${b64url(signature)}`; const resp = await fetch('https://oauth2.googleapis.com/token', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script reads service-account credentials from environment variables, generates an OAuth assertion, and sends it to Google endpoints, but there is no confirmation prompt, warning comment, docstring, or other user-facing disclosure in this file about accessing credentials and making authenticated network calls. This qualifies as a missing warning for safety-relevant credential access and outbound data transmission in a code file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: When run with --apply, the script creates a backup and overwrites the jobs JSON, potentially disabling jobs missing from the sheet, but there is no confirmation prompt or prior warning in the file that this operation changes scheduler state on disk. Because this is a file write with operational impact, it should be disclosed more explicitly to the user.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The markdown states that output cache files are written under a user directory, which affects local data persistence, but it provides no warning that job instructions may be stored on disk and reused later. For markdown files, user-impacting data handling behaviors should be disclosed when they could affect privacy or system state.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/load-sheet-instructions.mjs:8

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/reconcile-cron-from-sheet.mjs:6