Skill Auto Attach

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:31 PM UTC
• Version: 1.0.0

Overview

This skill is clearly intended to send workspace files to Telegram, but its implementation can automatically transmit any changed workspace file, not just documented file types, without per-file review.

Review this skill carefully before installing. It will run a watcher and can automatically send changed workspace files to Telegram; as written, it does not limit itself to documentation file types or ask before each send. Use only in a tightly controlled workspace with no secrets, credentials, private source, or sensitive files, and prefer a version with an explicit allowlist and confirmation step.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

• Location: auto-attach.sh:7

Finding

Unrestricted Automatic Exfiltration of Workspace Files to Telegram

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: auto-attach.sh:8

Finding

Predictable Shared Temporary Paths Permit Symlink Attacks, Collisions, and Local Data Exposure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly states it monitors workspace files and automatically sends new or updated documentation files to Telegram, but it does not present this as a prominent user warning or require explicit opt-in at the point of use. This creates a real risk of unintended exfiltration of sensitive local content, especially because file-change triggers are automatic and the destination is an external messaging channel.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · auto-attach.sh (reported line 22)May include surrounding context.

sh

log "Auto-attach script started. Watching $WATCH_DIR"

# Clean up temp files on exit
trap 'log "Script exiting - cleaning temp files"; rm -f "$TMP_DIR"/*; log "Watcher stopped"' EXIT INT TERM

# Watch for file changes
inotifywait -m -e create,modify -r --format '%w%f %e' "$WATCH_DIR" | while read -r file_path event; do

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · auto-attach.sh (reported line 22)May include surrounding context.

sh

log "Auto-attach script started. Watching $WATCH_DIR"

# Clean up temp files on exit
trap 'log "Script exiting - cleaning temp files"; rm -f "$TMP_DIR"/*; log "Watcher stopped"' EXIT INT TERM

# Watch for file changes
inotifywait -m -e create,modify -r --format '%w%f %e' "$WATCH_DIR" | while read -r file_path event; do

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Changed files are transmitted to Telegram automatically with no user-facing warning, approval step, or visibility into what content is being sent. This makes accidental disclosure of sensitive files very likely, especially because the watcher runs continuously over the workspace.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script monitors the entire workspace and automatically sends changed files to Telegram, which is an external messaging service, without any apparent scoping, allowlist, or stated business justification. In the absence of a manifest or explicit user consent flow, this is effectively continuous data exfiltration of potentially sensitive workspace contents.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest declares broad event triggers, "file-creation" and "file-modification," without any visible scoping, filtering, or path restrictions. In a skill described as automatically attaching files for Telegram, this can cause the skill to process unintended files, including sensitive or transient data, increasing the chance of unauthorized exfiltration or privacy-impacting behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.