Automation Workflows

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:36 AM UTC
• Version: 0.1.1

Overview

This is a non-executable automation playbook whose operational examples are disclosed and aligned with its stated purpose, though users should add privacy and approval safeguards before automating customer or payment workflows.

Before installing or using this skill, treat it as business-process guidance rather than a ready-made secure implementation. For workflows touching customers, payments, public posts, or CRM/accounting records, use least-privilege app permissions, test with non-production data, add approval steps before mass messaging or financial updates, and keep logs plus rollback procedures.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are very broad and include common business language such as 'save time' and 'automation', which can cause the skill to activate in situations where the user did not specifically request workflow automation guidance. Over-broad activation increases the chance of inappropriate invocation, irrelevant advice, or unintended handling of business context that belongs to a different skill.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill recommends automations that move customer, payment, and usage data across multiple systems and even send customer-facing communications, but it does not include safeguards around consent, least-privilege access, data minimization, validation, or rollback for accidental actions. In this context, omissions can lead to privacy violations, corrupted records, mis-segmentation, erroneous emails, or financial workflow mistakes at operational scale.

Session Persistence

Medium

• Category: Rogue Agent

Content

2. Flag customers with <50% of average usage
  3. Add flagged customers to "At Risk" segment in CRM
  4. Send re-engagement email campaign to at-risk customers
  5. Create task for me to personally reach out to top 10 at-risk customers
```

### Invoice and payment tracking

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.