Security audit

Ryder-Super-Pack

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only skill is not clearly malicious, but it directs agents into broad high-impact workflows involving sensitive data, persistent memory, command execution, and external report delivery without enough user control.

Install only if you are comfortable with an agent using this skill for broad professional automation. Before use, require explicit confirmation for command execution, external searches, file writes, memory storage, archive moves, and any Telegram/Discord delivery; do not let it process finance, customer, legal, or personal data unless paths, recipients, retention, and review steps are clearly controlled.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/dev.md:16
Finding: Unrestricted Environment Variable Collection During Debugging
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/finance.md:47
Finding: Sensitive Financial and Customer Data May Be Stored in Long-Term Agent Memory
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/legal.md:22
Finding: Data Subject Request Workflow Packages Personal Data Without Identity or Authority Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/marketing.md:32
Finding: Marketing Analytics Reports Are Automatically Sent to External Messaging Channels Without Review
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (27)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: ryder-super-pack description: Optimized super-skill collection for OpenClaw/Codex, merging Perplexity + Claude Code expertise across 11 domains. Features specialized reference loading (progressive disclosure), tool-integrated workflows (exec, fs, web_fetch), and persona-aligned frameworks. Use for high-stakes professional AI tasks requiring structured reasoning, templates, or domain-specific gap analysis. --- # Ryder Super-Pack (汪汪队超级包) - OpenClaw Edition Greetings, Mayor. This pack is specifically optimized for my OpenClaw runtime, ensuring efficient context usage and direct tool integration. #

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description is extremely broad and markets itself for 'high-stakes professional AI tasks' across many domains, which increases the chance it will be invoked for ordinary or sensitive requests without clear scope boundaries. In an agent ecosystem, overbroad activation criteria can cause unnecessary tool access and unsafe delegation into workflows involving exec, fs, or web capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The markdown advertises tool-first execution using exec, fs, web_fetch/web_search, and subagent orchestration, but it does not include any safety constraints, approval requirements, or warnings about modifying files, running commands, or pulling untrusted remote content. This creates a realistic path for unsafe execution or data exposure if the skill is triggered in a permissive runtime.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill directs the agent to generate a VARIANCE_REPORT.md file without warning the user that new artifacts will be created in the workspace. In high-stakes finance contexts, silent file creation can mislead users about what was produced, overwrite expected outputs, or leave sensitive financial analysis in shared workspaces without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow instructs automatic generation of JOURNAL_ENTRIES.md and maintenance of CLOSE_STATUS.md without warning or confirmation. Because these files can influence accounting operations and internal close processes, silent creation may cause users to rely on unreviewed outputs or expose sensitive operational status information in the workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The market-data workflow directs use of web_search and web_fetch against external financial sources without warning that the agent will initiate network access. In investment-research settings, undisclosed outbound requests can leak the user’s research interests, trigger compliance concerns, or fetch untrusted content that is then treated as analysis input.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest describes a structured super-skill collection for domain-specific reasoning and reference loading, and this file is specifically a finance reference. In that context, instructing the agent to use exec to run scripts that fetch data from arbitrary APIs such as Stripe and HubSpot expands from financial analysis guidance into generalized integration and data-engineering automation, which is not obviously required by the stated finance-reference purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The data-engineering section instructs running scripts to fetch data from third-party APIs and stage it in the workspace or memory/ without any disclosure about external access or data movement. In a finance context this is more dangerous because it may involve sensitive customer, billing, or CRM data, creating risk of unintended transfer, retention, or policy violations if done without explicit authorization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This workflow directs the agent to search for all personal data related to a requester and then write response and compliance log files, but it provides no safeguards around minimization, access control, verification strength, or safe handling of sensitive data. In an agent environment with filesystem and search tools, this can lead to over-collection, unnecessary duplication of personal data, and accidental disclosure into workspace artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs automatic delivery of generated marketing reports via Telegram/Discord, which can transmit analytics, campaign data, or other sensitive business information to external platforms without explicit user consent or a sensitivity check. In this context, the skill is operational and tool-enabled, so the omission is more dangerous because it normalizes exfiltration of potentially confidential data as part of routine workflow.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This reference instructs the agent to use exec-driven automation for portfolio prioritization and to move stale files into an archive, which crosses from passive guidance into autonomous system and filesystem modification. In a general-purpose super-skill, these actions can trigger unintended subprocess execution or data relocation without clear user consent, scope limits, or safety checks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The cleanup instruction tells the agent to move stale files to an archive based on age alone, but does not require warning the user or presenting a review list before relocation. This can cause operational disruption, hidden data movement, or loss of discoverability if important files are archived incorrectly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The invoice workflow directs the agent to read invoice files and persist extracted financial data into a tracker, creating a pathway for handling sensitive financial information without privacy controls or authorization checks. In a broad super-skill context, this is risky because it normalizes persistent processing of potentially confidential records as a default operational behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The invoice extraction workflow processes potentially sensitive billing documents and writes derived data to a finance tracker without any privacy warning, data-classification note, or consent requirement. This increases the likelihood of unauthorized exposure, over-collection, or accidental persistence of confidential financial information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill tells the agent to ingest interview transcripts and survey results and derive personas from them without any privacy or data-handling warning. User research data often contains sensitive personal, behavioral, or confidential business information, so processing it without caution increases the risk of over-collection, retention, or exposure in generated artifacts.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest frames the skill as a professional super-skill collection for structured reasoning and domain workflows, but this file specifically instructs use of exec for Python scripts, pdftotext, and yt-dlp. While tool integration is mentioned generally, encouraging arbitrary command execution for media extraction and local processing is a materially stronger capability than the stated research-and-synthesis purpose alone justifies.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill tells the agent to check memory/ for prior interactions without warning the user that historical interaction data may be accessed. In a sales context, that data may contain sensitive notes, personal information, or prior customer communications, making undisclosed access a privacy and confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill directs the agent to use web search and read tools to compile background summaries on external participants, which can affect individual privacy and may involve collecting personal information. The markdown does not include any caution about limiting collection, verifying relevance, or complying with privacy expectations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest describes a structured, domain-specific skill collection for high-stakes professional tasks, and this file is framed as a legal operations reference. However, the instruction to use web search to summarize the background of all external participants expands from legal operations into general people/background research, which is not clearly part of the stated legal purpose of this reference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 1% confidence
Finding: After review, no genuine language or locale policy violation is present in this file. The content does not force a specific human language or locale, so no SQP-3 finding should be reported.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: L12 directs creation of content-brief.md, and similar write behavior is also described later for MARKETING_REPORT.md and BATTLECARD.md. The skill description does not warn users that it will create files in the workspace, which is a user-data and system-state affecting behavior that should be disclosed in markdown.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow directs use of web_search to gather competitor features and user pain points, but does not disclose that this involves external network access. In a high-stakes professional skill, undisclosed outbound access can violate user expectations, leak contextual information through queries, or breach restricted-environment policies.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly instructs the agent to create and update workspace files like PRD_[FEATURE].md without telling the user that local files may be modified. In an agent setting, silent file writes can surprise users, overwrite existing work, or create unintended artifacts, even if the action is framed as normal PM workflow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest describes a collection for structured reasoning, templates, and domain-specific analysis, while this reference goes beyond pure research guidance by directing creation of concrete files such as RESEARCH_BRIEF.md and storage in memory/ for long-term retrieval. Those write-oriented operations are not highlighted in the manifest's description of a research/knowledge workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs the agent to create a RESEARCH_[COMPANY].md file without disclosing that it will write to local storage or asking for user approval. Even though this is a normal sales workflow, undisclosed file creation can surprise users, overwrite existing files, or leave sensitive prospect research on disk.
Content: No source excerpt is available for this finding.