Batch Executor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:24 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent batch-processing purpose, but it automatically executes tasks found in private corpus dumps while saving and committing raw content, so it needs careful review before use.

Install only if you are comfortable with an agent processing and acting on large private document exports. Before use, require an explicit execution plan, keep raw corpora out of git, avoid sensitive sources unless redacted, and approve any sub-agent, file mutation, API call, or commit that comes from imported content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:116
• Finding: Untrusted Corpus Instructions Can Be Promoted to Executable Agent Tasks<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:49-57` and `SKILL.md:116-127` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code Snippet ```markdown | Type | Description | Action | |------|-------------|--------| | TASK | Has a clear action verb + deliverable | EXECUTE | | IDEA | Speculative, "what if", product concept | SCORE (ICE) | | REFERENCE | Link, citation, spec, documentation | CATALOG | | DECISION | "We decided X", "going with Y" | RECORD | | HALF_THOUGHT | Fragment, incomplete, trails off | COMPLETE then re-classify | | MODEL_OUTPUT | AI-generated, assistant voice | EXTRACT core idea, discard wrapper | | DUPLICATE | Same as item #X | MERGE | | NOISE | Test, filler, meta-commentary | SKIP | ``` ```markdown Rules: 1. **Max 3 sub-agents concurrent.** Wait for one to complete before spawning another. 2. **QUICK items: execute inline** (no sub-agent overhead for < 5 min tasks). 3. **MEDIUM/HEAVY items: spawn sub-agent** with clear task description + acceptance criteria. 4. **Each sub-agent gets**: the item content, relevant context from other items, and the target artifact path. 5. **Track in manifest**: status → EXECUTING, then ✅ DONE / ❌ FAILED / ⚠️ PARTIAL. Sub-agent spawn template: ``` Task: [item summary] Context: [relevant items from this corpus] Deliverable: [specific file/artifact expected] Acceptance: [how to verify it's done] Workspace: [path] ``` ``` ### Technical Analysis The skill processes external corpora such as Google Drive dumps, ChatGPT exports, and Apple Notes. It classifies any item containing an action verb and deliverable as a `TASK`, after which the item may be executed inline or supplied directly to a sub-agent. The workflow does not require the agent to distinguish authorized user requests from quoted instructions, third-party document content, previous model output, or deliberately crafted prompt-injection text. The `MODEL_OUTPUT` classification only instruct ...[truncated 1560 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all imported corpus content as untrusted data rather than executable instructions. 2. Separate analysis from execution. By default, produce a proposed execution plan and require explicit user approval before performing corpus-derived tasks. 3. Record provenance for each item, including its source file, author where available, and whether the user explicitly authorized execution. 4. Detect and quarantine content that attempts to change roles, override prior instructions, request secrets, invoke tools, or direct the agent to ignore safety controls. 5. Require confirmation for sensitive operations, including: - Shell or code execution - Network requests - Credential or secret access - File deletion or modification outside an approved workspace - Publication or transmission to external services 6. Apply explicit tool, command, network-domain, and filesystem-path allowlists to inline tasks and sub-agents. 7. Pass sub-agents a structured task summary instead of raw attacker-controlled instructions whenever possible. 8. Preserve quoted source material in a clearly delimited data field and explicitly instruct sub-agents not to follow instructions contained in that field. 9. Add authorization and safety review states to the manifest, such as `UNTRUSTED`, `REVIEW_REQUIRED`, and `APPROVED_FOR_EXECUTION`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:134
• Finding: Sensitive Raw Corpora May Be Persisted in Plaintext and Captured in Git History<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:36-39` and `SKILL.md:134-140` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown Save ALL raw input to `systems/batch-executor/corpus/YYYY-MM-DD-SOURCE.md` BEFORE any processing. For file inputs: - PDF → extract text via `pdf` tool ``` ```markdown Checkpoint every 5 completed items: - Update manifest - Report to user: "[X]/[N] done. [Y] in progress. Top findings so far: [...]" - If user is idle (no response in 30s), continue - Commit progress to git ``` ### Technical Analysis The skill mandates saving all raw input before processing. Its intended input sources include ChatGPT exports, personal notes, and Google Drive content, all of which may contain credentials, personal information, private communications, proprietary documents, or other confidential data. The workflow subsequently requires periodic Git commits but does not instruct the agent to exclude the raw corpus directory, stage files selectively, redact sensitive information, scan for secrets, or verify whether a remote repository is configured. Plaintext workspace storage also lacks stated access controls, encryption, retention limits, and secure deletion requirements. Even if a sensitive file is deleted later, its contents may remain recoverable from Git history, local object databases, backups, clones, or configured remotes. Exploitation or disclosure through Git is conditional on the corpus files being tracked or otherwise included by the checkpoint operation. ### Attack Path 1. A user supplies a corpus containing private documents, credentials, tokens, personal data, or confidential conversation history. 2. The skill writes the complete raw corpus to `systems/batch-executor/corpus/YYYY-MM-DD-SOURCE.md` before redaction or classification. 3. During a five-item checkpoint, the skill performs a Git commit. 4. If the raw corpus or a derived file containin ...[truncated 946 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Obtain explicit user consent before persisting a complete corpus. 2. Default to processing sensitive source material in a restricted temporary directory outside the repository. 3. Store only the minimum data required for resumption and reporting. 4. Redact credentials, tokens, personal information, and confidential values before writing persistent artifacts. 5. Add `systems/batch-executor/corpus/` and other raw-data locations to `.gitignore`. 6. Replace broad Git operations with explicit staging of approved, sanitized manifest and report files. 7. Run secret and sensitive-data scanning before every commit. 8. Require separate user approval before pushing any commit to a remote repository. 9. Encrypt sensitive persisted data and restrict filesystem permissions to the current user. 10. Define retention and secure-deletion policies for raw corpora, temporary extraction files, reports, and backups. 11. Ensure shared outputs such as `.learnings/LEARNINGS.md` and `systems/batch-cognition/value-stack.md` contain only sanitized summaries rather than raw source content. 12. If sensitive information has already entered Git history, rotate exposed credentials and purge the data using an appropriate history-rewriting process, followed by cleanup of clones, remotes, and backups where feasible. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly requires saving all raw corpus input to disk before any processing, but provides no safeguards for secrets, personal data, regulated content, or user consent. In the context of Google Drive dumps, ChatGPT exports, and Apple Notes, this creates a substantial privacy and data-retention risk because highly sensitive data may be stored locally in plain form unnecessarily.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: This workflow mandates retaining raw corpus content and then redistributing item content and related context to downstream processing stages. For data sources like conversation exports, notes, and drive dumps, that materially increases the attack surface for natural-language leakage, including exposure of credentials, personal data, internal documents, and sensitive instructions to sub-agents or logs that do not need the full raw text.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill instructs broad propagation of corpus contents into manifests, execution context, status tracking, reports, and later learning artifacts, which multiplies the number of plaintext copies and derivative disclosures. In a corpus-scale executor, this is especially dangerous because the source material is likely heterogeneous and may contain confidential business data, private messages, or regulated information that should not be repeated across multiple files and agents.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The instruction to commit progress to git can permanently record corpus-derived content in repository history, making accidental disclosure much harder to undo than a normal file write. Because this skill operates on large personal or organizational exports, even brief manifest entries, checkpoints, or generated artifacts may embed sensitive information that then propagates into version control and backups.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: Appending outputs to shared files such as a value stack and learnings log spreads corpus-derived information beyond the original processing boundary without notice or isolation. This increases the chance that sensitive details from one batch are later exposed to unrelated workflows, users, or skills through shared context files.

Static analysis

No suspicious patterns detected.