Security audit

Flatastic

Security checks for vulnerabilities and agentic risk

Overview

This is a plausible Flatastic helper, but it relies on an unreviewed external CLI, stored login tokens, and broad authority to change shared household and expense data.

Install only if you trust the external flatastic CLI code on your machine and are comfortable with the agent changing shared household records. Treat the saved config file as sensitive because it contains a session token, and use explicit Flatastic wording plus confirmations for deletes, expenses, reminders, and posts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tool Parameter Abuse

High

Category: Tool Misuse
Content: - `GET /chores/history` — Completion history - `POST /chores` — Create new chore - `POST /chores/update` — Update chore - `DELETE /chores/id/:id` — Delete chore ### Shopping - `GET /shoppinglist` — List all items
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: - `GET /shoppinglist` — List all items - `POST /shoppinglist` — Add item `{name: "..."}` - `GET /shoppinglist/toggle_item?id=` — Toggle bought - `DELETE /shoppinglist/item/:id` — Delete item - `POST /shoppinglist/delete_bought_items` — Clear bought ### Expenses (Cashflow)
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: - `GET /cashflow/settlement` — Who owes whom - `GET /cashflow/statistics` — Expense stats - `POST /cashflow` — Add expense - `DELETE /cashflow/id/:id` — Delete expense ### Shouts - `GET /shouts` — List shouts
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ### Shouts - `GET /shouts` — List shouts - `POST /shouts` — Post shout `{shout: "..."}` - `DELETE /shouts/id/:id` — Delete shout ### WG - `GET /wg` — WG info with flatmates
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The manifest description says to use the skill when the user asks about "chores, WG tasks, shopping list, expenses, or Flatastic," which is a broad invocation scope rather than a specific trigger set. Requests about chores, shopping, or expenses are common everyday topics and the file does not provide exclusion conditions or negative examples to limit when the skill should activate.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill documents credential-based authentication and persistent storage of a token plus user/WG data in a local config file without any warning about sensitive data handling, file permissions, or logout/revocation. This increases the risk of credential theft or unintended disclosure on shared or compromised systems, especially given the household/shared-device context.

Session Persistence

Medium

Category: Rogue Agent
Content: - `GET /chores/remind?id=` — Send reminder - `GET /chores/statistics` — Get point statistics - `GET /chores/history` — Completion history - `POST /chores` — Create new chore - `POST /chores/update` — Update chore - `DELETE /chores/id/:id` — Delete chore
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: The skill's example invocations are written exclusively in German, such as "Was steht heute an?" and "Ich hab 24€ für Pizza bezahlt," with no indication that users may interact in other languages. This can amount to an implicit language preference without user opt-in.

Static analysis

No suspicious patterns detected.