Security audit

Multi Workplace

Security checks for vulnerabilities and agentic risk

Overview

The skill has a plausible workplace-management purpose, but it gives broad project-scanning, file-writing, memory-sync, and agent-spawning workflows too little containment for safe default installation.

Install only for trusted repositories and expect it to read project structure, write .workplace state, update IDE context files, start background agent workflows, and sync summaries to supermemory. Review generated agent files and chat.md before starting agents, avoid running the watcher on untrusted cloned .workplace directories, and inspect diffs before using sync or init on important projects.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/build.sh:13
Finding: Remote Installer Is Recommended Through a curl-to-shell Pipeline
Content: View full analysis
/dev/null; then echo "❌ Rust toolchain not found. Install via: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh" exit 1 fi ``` ### Technical Analysis The script does not automatically run the installer. However, when Cargo is unavailable, it explicitly instructs the user to fetch mutable content from `https://sh.rustup.rs` and pipe it directly into a shell. The domain is the recognized Rust installer endpoint, and HTTPS with TLS 1.2 is required, which reduces—but does not eliminate—the risk. The command does not pin an installer version, verify a checksum or signature, or allow the downloaded script to be reviewed before execution. Consequently, the effective code executed by the user can change after this Skill has been audited. This installation method also exceeds the minimum behavior needed from the build script. The script only needs to report that Rust is missing and direct users to verified installation documentation. ### Attack Path 1. The user runs `scripts/build.sh` on a system without Cargo. 2. The script displays the `curl ... | sh` installation command. 3. The user copies and executes the suggested command. 4. If the upstream installer endpoint, DNS resolution, certificate trust chain, delivery infrastructure, or installer source is compromised, the response contains attacker-controlled shell code. 5. The shell executes that response immediately with the user’s privileges. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user account. This may permit access to the user’s source code, local credentials, SSH configuration, development tokens, and writable application or shell confi ...[truncated 131 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/init_workplace.sh:96
Finding: Unescaped Metadata Is Embedded in sed Programs
Content: View full analysis
"$WP_DIR/config.json" ``` ### Technical Analysis Several values are inserted directly into sed expressions rather than being passed as data: - `WP_NAME` can come from the `--name` argument or a directory basename. - `TARGET_PATH` is derived from a user-selected path. - `WP_HOSTNAME` comes from the local hostname. These values are not escaped for the sed delimiter (`|`), backslashes, ampersands, or newline characters. At minimum, crafted input can break initialization or corrupt the generated JSON. On GNU sed, specially constructed multiline replacement data can alter the generated sed program and introduce execution-capable sed behavior such as the `e` substitution flag. Using sed also fails to apply JSON string escaping. Ordinary metadata containing quotes, backslashes, or control characters can therefore generate invalid `config.json`. ### Attack Path 1. An attacker provides a project directory with a crafted basename, or persuades the victim to initialize it using an attacker-controlled `--name` value. 2. The victim runs `scripts/init_workplace.sh` or invokes `workplace init`. 3. The unescaped value is interpolated into a sed program. 4. Sed interprets delimiter, newline, or command syntax from the metadata as part of its program rather than as literal replacement data. 5. Depending on the platform and payload, initialization fails, the configuration is corrupted, or attacker-selected shell commands are executed with the victim’s privileges. ### Impact Assessment The direct impact includes arbitrary command ...[truncated 343 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: references/agent-system.md:49
Finding: Repository-Controlled Agent Definitions Are Elevated Into Agent Prompts
Content: View full analysis
.md` from the active repository and inserts its body directly into the prompt used to spawn an agent. A cloned or imported repository can control this file. No trust distinction is established between Skill-owned instructions and repository-owned content. The design does not require review or approval of agent definitions, delimit them as untrusted data, restrict their permitted actions, or define a reduced tool and filesystem policy for spawned sessions. As a result, malicious repository content can present itself as authoritative agent instructions. It can redirect the spawned agent’s goals, request sensitive file access, initiate unrelated commands, or attempt to override safety constraints. ### Attack Path 1. An attacker commits a malicious `.workplace/agents/.md` file to a repository. 2. The victim cl ...[truncated 875 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: references/agent-system.md:113
Finding: Unauthenticated chat.md Messages Can Initiate Agent Handoffs
Content: View full analysis
= caps .get(3) .map(|m| { m.as_str() .split(',') .map(|s| s.trim().to_string()) .filter(|s| !s.is_empty()) .collect() }) .unwrap_or_default(); let message = caps.get(4)?.as_str().to_string(); ``` ### Technical Analysis `.workplace/chat.md` is a writable plaintext file. The parser validates only message syntax; it does not authenticate the sender, bind the message to a live agent session, verify a signature, enforce a nonce, or validate that the sender is authorized to address the recipient. The orchestrator is instructed to start the target agent and include the message as handoff context. Any local process, compromised agent, repository hook, or automation with write access to the project can therefore impersonate a trusted agent and inject tasks. ### Attack Path 1. ...[truncated 1081 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/rust-server/src/main.rs:73
Finding: File Watcher Follows Symbolic Links for Writable State Files
Content: View full analysis
) { let status_path = workplace_dir.join("process-status.json"); // Read existing status or create new let mut proc_status: serde_json::Value = if let Ok(content) = fs::read_to_string(&status_path) { serde_json::from_str(&content).unwrap_or(serde_json::json!({})) } else { serde_json::json!({}) }; proc_status["server"] = serde_json::json!({ "status": status, "pid": std::process::id(), "startedAt": Utc::now().to_rfc3339(), "lastEvent": Utc::now().to_rfc3339(), "error": error, }); if let Ok(json) = serde_json::to_string_pretty(&proc_status) { let _ = fs::write(&status_path, json); } } ``` The same implementation also creates or opens `.workplace/chat.md` using ordinary filesystem operations: ```rust let workplace_dir = PathBuf::from(&args[1]); let wp_internal = workplace_dir.join(".workplace"); let chat_file = wp_internal.join("chat.md"); if !chat_file.exists() { if let Err(e) = fs::write(&chat_file, "") { eprintln!("Error creating chat.md: {}", e); std::process::exit(1); } } ``` ### Technical Analysis The server accepts a project path and writes to `.workplace/process-status.json` using `fs::write`. It does not inspect path components with `symlink_metadata`, reject symbolic links, canonicalize the final target, or verify that the resolved file remains inside the selected `.workplace` directory. On supported operating systems, ordinary file writes follow symbolic links. A malicious repository can therefore provide `.workplace/process-status.json` as a symbolic link to another file writable by the victim. The server writes its JSON status ...[truncated 1118 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/rust-server/Cargo.toml:11
Finding: Rust Dependencies Are Resolved Without a Committed Lockfile
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill presents itself as a workplace-management and orchestration tool, but the documented behavior also includes building a Rust binary and depending on the local toolchain without clearly foregrounding that capability. Hidden or underemphasized build/execution behavior increases supply-chain and local-execution risk because users may authorize the skill for project management while unintentionally permitting compilation of local code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill presents itself as a workplace-management and orchestration tool, but the documented behavior also includes building a Rust binary and depending on the local toolchain without clearly foregrounding that capability. Hidden or underemphasized build/execution behavior increases supply-chain and local-execution risk because users may authorize the skill for project management while unintentionally permitting compilation of local code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill presents itself as a workplace-management and orchestration tool, but the documented behavior also includes building a Rust binary and depending on the local toolchain without clearly foregrounding that capability. Hidden or underemphasized build/execution behavior increases supply-chain and local-execution risk because users may authorize the skill for project management while unintentionally permitting compilation of local code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The README states that the skill scans file structures, reads markdown files, and generates or updates IDE context files like CLAUDE.md, .cursor/rules/workplace.mdc, and opencode.jsonc, but it does not clearly warn users that project files may be read from and written to. In this context, the skill operates across multiple workplaces and propagates context into developer tooling, so insufficient disclosure increases the risk of accidental modification of repositories, leakage of sensitive project context into generated files, or trust boundary confusion.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The example agent triggers include broad, common phrases like "code", "implement", "fix", and "refactor" without any scoping to explicit workplace commands or user confirmation. In a multi-agent orchestration skill that can start agents and hand off tasks automatically, such vague triggers can cause unintended activation and autonomous behavior on normal conversation, increasing the chance of unrequested file changes or workflow execution.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill explicitly describes shell-backed operations such as running initialization, scan, and build scripts, but it declares no tool scope or allowed-tools restrictions. That creates an unnecessary trust gap: an invoking agent could use shell access more broadly than users expect, including modifying files under project directories and home-directory registry paths.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger text is broad enough to activate on generic project-management or codebase-switching discussions, increasing the chance that the skill runs in contexts where users did not intend file operations, registry changes, or shell-backed actions. In a skill that can modify local workspace state and sync to external tools, over-triggering materially raises the risk of unintended side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documents writing to files such as current.json, registry.json, project-local .workplace content, and syncing instructions into IDE configuration files, but it does not prominently warn users that local files will be created or modified. That lack of disclosure is risky because the skill operates across home-directory and repository paths, making accidental state changes or config pollution more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file is a production deployment template describing build, deploy, rollback, and health-check steps, but it contains no warning about potential effects on system availability, data integrity, or the need to verify commands before execution. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data, privacy, or system integrity.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes generic terms like "kernel," "structure," and "scan files," which can match ordinary user requests and unintentionally invoke a persistent background agent with filesystem scanning and memory-sync behavior. In this skill's context, accidental activation is more dangerous because the agent is designed to recurse through project directories, write metadata files, and sync summaries externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The template instructs the agent to perform persistent directory scanning, generate and overwrite files under .workplace, and send project summaries to supermemory, but the visible role/context text does not present explicit warnings, consent, or data-handling limits. That omission increases the risk of users unknowingly exposing sensitive filenames/project metadata or permitting unintended writes and external synchronization.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The listed triggers include generic terms like "code," "implement," "fix," "refactor," and "build," which can appear in many ordinary developer conversations and requests. The document does not provide constraints, activation context, or negative examples to clarify when these keywords should or should not activate the agent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file describes operations that create, append to, or replace content in user files such as CLAUDE.md, .cursor/rules/workplace.mdc, and opencode.jsonc. While marker comments reduce clobbering risk, the guide does not warn users that existing project files will be modified or that content may be overwritten between markers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide instructs creating directories, initializing Git, and running an init script against an arbitrary project path without explicitly warning that these actions will modify the target directory. In an agentic context, this can lead to unintended repository creation and persistent filesystem changes in the wrong location, especially if the user believes the operation is read-only setup guidance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The existing-project flow mixes scanning with mutating initialization and later file generation, but does not clearly tell the user that the process will write .workplace content and may alter project metadata/docs. In a multi-agent workplace skill that auto-detects projects and syncs context across tools, ambiguous write behavior increases the risk of unintended changes to real repositories.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code creates the target directory and then proceeds to generate a full .workplace structure, registry entries under $HOME, and later modifies child workplace configs. While the script includes status output during execution, it does not clearly disclose beforehand that it will write to both the target path and a central per-user registry, which is safety-relevant for a filesystem-mutating initializer.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The runtime instructions explicitly tell agents to write to shared coordination files such as .workplace/chat.md and .workplace/process-status.json without describing integrity controls, authorization boundaries, or validation. In a multi-agent system, any agent that can arbitrarily modify shared state can spoof handoffs, forge completion or error states, tamper with workflow history, or influence orchestrator behavior, which creates a real coordination and trust-boundary weakness.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 15% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/build.sh (reported line 18)May include surrounding context.
sh
fi if ! command -v cargo &>/dev/null; then echo "❌ Rust toolchain not found. Install via: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh" exit 1 fi

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/agent-system.md:55