automate

• Outcome: Pass
• Latest audit: Sep 19, 2026 · 7:59 PM UTC
• Version: 1.0.0

Overview

This skill helps users draft new Codex Automations with review gates before opening the editor, and its integration discovery is disclosed and purpose-aligned.

Review the automation draft carefully before approving, especially any Slack, repository, PagerDuty, Linear, Sentry, or MCP integration it will use. Installing the skill is reasonable, but created automations can run later and act through connected services, so only approve drafts whose trigger, tools, and deferred editor settings you understand.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 71% confidence

Finding

The same metadata-handling behavior appears twice in the findings because it can persist local session-derived MCP identity into automation configuration and prompt content. This creates a risk of unintended disclosure of environment-specific integration details and can couple saved automations to sensitive user/session state.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

- `serverIdentifier` — the scoped folder name the agent runtime uses (e.g. `dashboard-team-1-Linear`, `plugin-pagerduty-pagerduty-mcp`, `cursor-app-control`).
- `serverName` — the plain name the user configured on cursor.com (e.g. `Linear`, `pagerduty-mcp`, `Databricks SQL`).

Write `serverName` into `workflow.actions[].mcp.server.name` and any `@[MCP: ...]` prompt mentions. Never write `serverIdentifier` / the folder name, never invent or paraphrase a prefix (`team-…`, `user-…`, `<orgId>-…`), and never hand-strip prefixes from the folder name — many `serverName`s contain spaces (e.g. `Databricks SQL`, `statsig read only console`), so string-munging the identifier is fragile. The Automations editor matches on trim + lowercase, so casing does not matter, but pass the exact `serverName` from `SERVER_METADATA.json` anyway. When you have a useful URL, you may also pass `templateMcpHints: [{ name: <serverName>, url: <serverUrl> }]` so a URL match can rescue a name drift.

**Eligibility — dashboard-backed servers only.** Only dashboard-backed servers appear in the Automations editor's `GetAvailableMcpServers` response, which is what the editor uses to resolve a prefilled `mcp` action to a connected server. Their `serverIdentifier` always begins with one of these prefixes:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 71% confidence

Finding

The same metadata-handling behavior appears twice in the findings because it can persist local session-derived MCP identity into automation configuration and prompt content. This creates a risk of unintended disclosure of environment-specific integration details and can couple saved automations to sensitive user/session state.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

- `serverIdentifier` — the scoped folder name the agent runtime uses (e.g. `dashboard-team-1-Linear`, `plugin-pagerduty-pagerduty-mcp`, `cursor-app-control`).
- `serverName` — the plain name the user configured on cursor.com (e.g. `Linear`, `pagerduty-mcp`, `Databricks SQL`).

Write `serverName` into `workflow.actions[].mcp.server.name` and any `@[MCP: ...]` prompt mentions. Never write `serverIdentifier` / the folder name, never invent or paraphrase a prefix (`team-...`, `user-...`, `<orgId>-...`), and never hand-strip prefixes from the folder name — many `serverName`s contain spaces (e.g. `Databricks SQL`, `statsig read only console`), so string-munging the identifier is fragile. The Automations editor matches on trim + lowercase, so casing does not matter, but pass the exact `serverName` from `SERVER_METADATA.json` anyway. When you have a useful URL, you may also pass `templateMcpHints: [{ name: <serverName>, url: <serverUrl> }]` so a URL match can rescue a name drift.

**Eligibility — dashboard-backed servers only.** Only dashboard-backed servers appear in the Automations editor's `GetAvailableMcpServers` response, which is what the editor uses to resolve a prefilled `mcp` action to a connected server. Their `serverIdentifier` always begins with one of these prefixes:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

Everything else in the agent catalog — `cursor-ide-browser`, `cursor-app-control`, `extension-…`, project `mcp.json` servers, and other local servers — does NOT appear in the dashboard catalog. Treat those as ineligible for the `mcp` action: do not add them to `workflow.actions`, do not reference them in `@[MCP: ...]` prompt mentions, and do not assume they will resolve when the editor opens. Prefilling an ineligible server lands the row in the blocked "Set up MCP" state and prevents the user from saving.

If one usable, dashboard-eligible catalog server clearly matches the user's requested integration, use it without asking the user to spell the server name. A name from the user prompt, a screenshot, a skill file, a workflow template, marketplace docs, or company convention is not proof.

If the catalog does not contain a usable, dashboard-eligible server, do not call that MCP, do not add an `mcp` action for it, and do not include `@[MCP: ...]` prompt mentions. Servers that are missing, disabled, or still need setup count as unavailable for prefill. Ask the user to set it up first, or leave the MCP out of the draft and record "Set up/select <integration> in the Automations editor" in **To finish in editor**. Unknown MCP server names are not valid deferred tool rows because prefilled missing MCPs block save.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

md

#### GitHub / GitLab repo scope

Accept natural repo nicknames; do not ask for `owner/repo` format first, and do not ask the user to list repos before trying scoped CLI discovery. Order:

1. **Exact or current repo.** If the user gave exact `owner/repo`, said "this repo", or the current checkout is the obvious target, use `gh repo view owner/repo --json defaultBranchRef,nameWithOwner` or `gh repo view --json defaultBranchRef,nameWithOwner` to fetch repo + default branch. For GitLab, use the equivalent `glab repo view` / project view command when available. Run auth status only if the exact lookup fails due to auth.
2. **Several named candidates.** If the user named several repo candidates, do not run an unscoped search. Resolve exact `owner/repo` candidates with lookup, or run scoped discovery only when a shared owner/org/namespace, current checkout, or product context narrows the search. If no scoped lookup is available, use `AskQuestion` over the user-named repos plus **Pick in Automations UI** before any CLI lookup.

Static analysis

No suspicious patterns detected.