T06 · System Persistence
Error
- Location
SKILL.md:97- Finding
Automatic Installation of a Persistent Weekly Agent Task
- Content
View full analysis
- Remediation
View remediation
Security audit
Retrospective
Security checks for vulnerabilities and agentic risk
Overview
This retrospective skill is useful in purpose, but it automatically creates an ongoing weekly agent job that reads and updates persistent memory and reviews sensitive configuration areas without enough user control.
Review this skill carefully before installing. It should be changed to make the weekly cron job opt-in, show the exact schedule and payload before creation, provide disable/removal instructions, avoid broad natural-language triggers, and prohibit reading or writing raw secrets. Use it only if you are comfortable with recurring agent access to memory and persistent updates to MEMORY.md.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:14- Finding
Overbroad Inspection of Memory, Credentials, Environment Variables, and Workspace Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill auto-schedules a weekly cron job on first use without a clear consent step, creating persistent background execution from a one-time or accidental invocation. This is high risk because it establishes ongoing autonomous behavior that reads memory, evaluates system state, and writes files repeatedly, expanding both the blast radius and duration of any mistaken activation or harmful logic.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases are broad and map to common conversational language such as 'reflect', 'review my work', and 'what went well', making accidental invocation plausible. In context, accidental activation is more dangerous because the skill performs persistent writes and may auto-schedule recurring cron jobs, so a casual phrase could lead to unanticipated state changes and background automation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs writing a retrospective to memory/retro-YYYY-MM-DD.md without warning the user that it will persistently modify workspace data. This is risky because users may expect an analysis-only operation, while the skill silently creates durable records that may contain sensitive operational details, errors, or inferred judgments.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documentation expands behavior beyond the stated report-writing purpose by also instructing updates to MEMORY.md, creating an additional persistent side effect. This is dangerous because long-term memory/state may be altered without explicit user awareness or consent, potentially introducing inaccurate summaries, overwriting important context, or causing future agent behavior to drift based on unintended state changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction to update MEMORY.md changes long-term agent state without an explicit consent or warning step. This is especially dangerous because MEMORY.md influences future behavior, so silent edits can propagate mistakes, stale conclusions, or sensitive information into later sessions and decisions.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Bad: "Scraping was hard" Good: "Spent ~15 turns fighting Akamai bot detection on COS/Arket. Root cause: H&M Group sites require full browser JS execution. No curl/Playwright workaround exists." ## Recommending skills without checking Bad: "Install flaresolverr to fix Cloudflare issues" Good: "flaresolverr v1.0.0 — runs a proxy that solves Cloudflare challenges. Would help with Lululemon (aggressive CF) but not COS/Arket (Akamai, different stack)."
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The Output Format section says to write the retro to
memory/retro-YYYY-MM-DD.md, implying a single report output. Later guidance says to "Update MEMORY.md with key findings after the retro," and the cron payload repeats that instruction, so the documentation is internally inconsistent about whether the skill only writes the retrospective file or also modifies long-term memory.- Content
Static analysis
No suspicious patterns detected.