Security audit

Workplace

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned but needs Review because it can persistently alter project and agent state, spawn agents, and sync project context into external memory or IDE instruction files without enough guardrails.

Install only if you want this skill to manage project metadata across repositories and are comfortable with persistent local state, background agent workflows, and context being written into IDE config files and supermemory. Before using it, review generated .workplace files, avoid syncing untrusted agent definitions into IDE instructions, require confirmation before deployment or child-repository initialization, and inspect any Rust installation command instead of piping a remote script directly to the shell.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/build.sh:12
Finding: Remote Rust Installer Is Recommended Through a Direct Network-to-Shell Pipeline
Content: View full analysis
/dev/null; then echo "❌ Rust toolchain not found. Install via: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh" exit 1 fi ``` ### Technical Analysis When Cargo is unavailable, the build script prints an actionable command that downloads mutable content from `https://sh.rustup.rs` and immediately passes it to a shell. The build script does not execute this command automatically, and the domain is the conventional Rust installer endpoint. Nevertheless, the recommended procedure creates a direct remote-code-execution channel without artifact pinning, checksum validation, signature verification, or an inspection step. TLS options protect the connection in transit but do not make the retrieved payload immutable. Compromise of the remote service, its delivery infrastructure, DNS resolution, or a trusted certificate authority could change the code executed after the Skill has been reviewed. This behavior exceeds the minimum privilege necessary to explain that Rust is required. The Skill can instead direct users to official installation documentation or provide a verifiable, staged installation procedure. ### Attack Path 1. A user invokes `scripts/build.sh` on a system where Cargo is not installed. 2. The script displays the `curl ... | sh` installation command. 3. The user copies and executes the suggested command. 4. `curl` retrieves the current response from the external endpoint. 5. The response is passed directly to `sh` without local inspection or cryptographic artifact verification. 6. Any malicious content delivered by the endpoint executes with the permissions of the invoking user. ### Impact Assessment A substituted installer can exe ...[truncated 481 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: references/agent-system.md:55
Finding: Project-Controlled Agent Definitions Are Promoted into Agent and IDE Instructions Without a Trust Boundary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/rust-server/src/main.rs:34
Finding: Unauthenticated Chat Messages Can Spoof Agents and Trigger Handoff Orchestration
Content: View full analysis
Option { // Pattern: [sender-to-recipient]: message // Pattern: [sender-to-recipient] @ [target1, target2]: message let re = Regex::new( r"^\[([a-zA-Z0-9_-]+)-to-([a-zA-Z0-9_-]+)\](?:\s*@\s*\[([^\]]*)\])?\s*:\s*(.+)$", ) .ok()?; let caps = re.captures(line.trim())?; let sender = caps.get(1)?.as_str().to_string(); let recipient = caps.get(2)?.as_str().to_string(); let broadcast: Vec = caps .get(3) .map(|m| { m.as_str() .split(',') .map(|s| s.trim().to_string()) .filter(|s| !s.is_empty()) .collect() }) .unwrap_or_default(); let message = caps.get(4)?.as_str().to_string(); Some(ChatMessage { timestamp: Utc::now().to_rfc3339(), sender, recipient, broadcast, message, line_number: 0, }) } ``` The documented consumer behavior is: ```text When a handoff message is detected: - Read the full `chat.md` for conversation context - Start the target agent with the handoff context included ``` ### Technical Analysis The parser considers any line matching the expected text format to be a valid agent message. It does not verify that: - The claimed sender corresponds to an active and authenticated agent session. - The sender is authorized to contact the recipient. - The recipient exists. - The requested handoff is listed in the sender’s `handoff_to` allowlist. - The message was generated through a trusted channel. - The message is fresh, signed, or protected against replay. The watcher emits parsed messages to standa ...[truncated 1612 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code chunk does not implement the declared end-user functionality. It is only a support script for compiling and packaging a binary called workplace-server. While this may be part of the skill's internal implementation, the chunk itself materially differs from the described behavior and shows none of the workplace-management, agent orchestration, syncing, or UI features claimed in the description. Therefore the description does not accurately represent what this supplied code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: The declared description presents a broad workplace management platform with agent orchestration, switching among workplaces, context syncing to external tools, and chat-platform UI features. The supplied code chunk is much narrower: it is an initialization script that sets up a .workplace folder, writes config/templates, scans files, detects parent/child repository relationships, and updates a central local registry/current pointer. While this behavior is related to the general workplace concept and partially matches the 'workplace init' portion of the description, the description materially overstates what this code actually does. Additionally, the script includes concrete behavior—such as recursive auto-initialization of child repositories and cross-linking them in config—that is not explicitly described. Therefore the description does not accurately represent this specific code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broad workplace platform with orchestration, agent management, context syncing, deployment, auto-discovery, and chat UI features. The supplied code chunk is much more limited: it only tracks loaded/open workplaces via registry.json and loaded.json and supports list/load/unload/status operations. While this is related to workplace management, it does not implement most of the prominent capabilities claimed in the description. Therefore the description materially overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a broad workplace-management and multi-agent orchestration system with many user-facing commands and integrations. The supplied code chunk is much narrower: it is a local watcher process for one workplace directory that monitors .workplace/chat.md, parses messages of the form [sender-to-recipient]: message (optionally with broadcast targets), prints JSON events, and writes process status metadata. While this does relate to inter-agent communication inside a workplace, it does not implement the primary advertised capabilities such as managing multiple workplaces, switching codebases, scanning for projects, import/export, context syncing, deployment, or chat-platform UI. Therefore the description materially overstates and misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The agent definition example uses very broad trigger phrases such as "code," "fix," and "refactor," which are common in normal developer conversations and can cause unintended agent activation or misrouting of tasks. In a multi-agent orchestration skill that also syncs context across tools and workspaces, accidental invocation can expose workspace context, perform unexpected actions, or create confusing autonomous behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README states that workplace sync will generate or update files like .cursor/rules/workplace.mdc, CLAUDE.md, and opencode.jsonc instructions, but does not warn that existing project files may be created or overwritten. Because these files influence IDE and agent behavior, silent modification can unexpectedly change developer tooling, inject stale or unsafe workspace instructions, or destroy user-authored configuration.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill describes shell-backed operations such as running init/scan/build/loaded-workplaces scripts and invoking a workplace server, but it does not declare any explicit tool restrictions. In a skill that can switch projects, write registry state, and trigger build or deploy-adjacent flows, missing scope boundaries increases the chance of over-privileged execution or unsafe tool use by an agent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is configured to activate on broad phrases like managing projects, switching codebases, multi-agent workflows, and similar variants, not just explicit workplace commands. Over-broad triggering can cause the skill to engage in unrelated contexts and perform state-changing actions on projects or registry files when the user did not intend to invoke workplace management.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documents automatic writes to current.json, registry.json, session state, possible auto-creation of sessions, and later references deploy and external IDE sync behaviors, but it does not present clear user-facing warnings or confirmation requirements. In a multi-project context, silent state changes and external sync/deploy side effects can leak context, overwrite state, or trigger unintended operational actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list includes generic phrases like "kernel," "structure," and "scan files," which can match ordinary user conversation and unintentionally activate a persistent background agent. In this skill, accidental activation is more dangerous because the agent is designed to recursively scan the project, write status artifacts, and sync summaries to external memory, expanding the consequences of a misfire beyond a simple chat response.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The kernel description and behavior authorize persistent directory scanning, generation of local files under .workplace/, and syncing project summaries to supermemory, but the skill metadata does not clearly warn users about these side effects. This weakens informed consent and can lead to unexpected collection and external propagation of sensitive repository structure or project facts, particularly in multi-project environments.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list for the sample agent includes very generic words like "code," "fix," "build," and "refactor," which can cause unintended agent activation during ordinary conversation. In a multi-agent orchestration system, accidental activation can cascade into file reads, writes, and spawning additional sessions, increasing the chance of unintended actions on user projects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The agent instructions explicitly direct writing to .workplace/chat.md and later to process-status.json, but the documentation does not clearly warn that using the skill will modify workspace files. This can surprise users, alter repository state, and potentially interfere with tooling, automation, or audits in project directories.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The kernel workflow instructs the system to save workplace structure to external memory using a workplace UUID container tag, without any consent, scoping, or data-minimization language. Because workplace structure can include repository layout, filenames, and other sensitive project metadata, exporting it to external memory broadens data exposure beyond the local project boundary.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/commands.md (reported line 169)May include surrounding context.
md
1. Resolve the target by path, UUID, or name from `registry.json` 2. Verify `.workplace/config.json` exists at the resolved path 3. Add entry to `loaded.json` with UUID, name, path, timestamp, and source 4. If not already linked to the current workplace, optionally add to `linked[]` **Example:**

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The deploy command explicitly allows optional execution of deployment commands from workplace documentation. In a multi-project, multi-agent skill that reads per-project markdown files, this creates a clear path for untrusted or stale project content to influence real command execution, increasing the risk of accidental or unsafe actions on the host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide instructs copying project structure, agent instructions, and deployment details into external IDE configuration files without warning that this may expose sensitive internal context to third-party tools or plugins. In this skill's context, workplace data spans multiple projects, agents, memory, and deploy environments, so syncing can unintentionally broaden the confidentiality boundary and leak operational or proprietary information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The re-init flow describes automatically setting parent relationships, mutating linked workplace metadata, and rebuilding trees for both workplaces, which introduces cross-project side effects without an explicit warning or approval boundary. Because this skill is designed to orchestrate multiple project directories and sync state between them, silent cross-workplace updates are more dangerous than in a single-project tool and can corrupt metadata or modify an unintended related repository.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The UI flow allows irreversible deletion of saved chat sessions via a single button path with no explicit confirmation prompt, undo option, or mention of transcript retention effects. In a chat-based interface where button presses are easy to trigger accidentally, this can cause unintended loss of session metadata and potentially associated conversational context across workplaces.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script creates directories and files under the target path and also updates a global registry in $HOME without any explicit confirmation or clear upfront disclosure. In an agent/skill context, that hidden state change can surprise users, alter unrelated environments, and persist metadata across projects, which is risky even if the behavior is part of the intended feature set.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: When a parent workspace is detected, the script automatically recurses into child repositories and initializes them, creating files and modifying configs without separate consent for each child. In a multi-project agent skill, this broadens the blast radius from one requested directory to many repositories, making unintended persistent modification more dangerous.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The server converts parsed chat lines into JSON and prints them to standard output, which transmits user-provided message content and participant identifiers outside the watched file. While the code logs that it is watching the file, it does not disclose that message contents will be emitted to stdout for downstream consumption.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The runtime description says the system reads .workplace/config.json, .workplace/structure.json, deploy configuration, and injects summarized contents into agent prompts, but it does not explicitly warn users that project metadata and context will be consumed and propagated between agents. This is a markdown-file disclosure issue because the behavior could affect privacy and workspace data handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The markdown shows workplace status returning full filesystem paths and host identifiers, which can reveal sensitive environment details if surfaced to users or logs. This section does not include any warning or disclosure about exposing local system metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file directs the skill to write .cursor/rules/workplace.mdc and later opencode.jsonc, which affects user project configuration files. While the Claude Code section mentions avoiding clobbering user content, the Cursor and OpenCode sections do not provide a comparable warning about overwriting or altering existing files.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/agent-system.md:55