T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:51- Finding
Untrusted Communication Content Is Processed by Tool-Enabled Agents Without Prompt-Injection Isolation
- Content
View full analysis
- Remediation
View remediation
Security audit
Ghostty — Your Always-On Digital Self
Security checks for vulnerabilities and agentic risk
Overview
This skill asks for broad always-on access to private communications and can send messages or accept calendar invites as the user without enough approval, privacy, or credential safeguards.
Review this carefully before installing. Do not enable direct sending or calendar auto-accept unless you explicitly want autonomous actions in your name, and prefer requiring approval for every outbound message or calendar change. Store credentials outside the workspace in a secret manager or OS keychain, restrict channel scopes, and avoid feeding broad message exports into the profile builder unless you are comfortable creating persistent communication-derived data.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/channel-monitors.md:7- Finding
Long-Lived Communication Service Credentials Are Stored in Plaintext Workspace Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill markets itself as an always-on communication proxy with parallel monitoring, drafting, routing, and escalation across multiple channels, but the described implementation does not actually provide those integrated controls and mainly builds a static voice profile plus prompts for hypothetical sub-agents. This kind of description-behavior mismatch can mislead users into overtrusting the automation model, especially around impersonation, monitoring, and message handling in sensitive personal channels.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Trigger phrases like 'be my digital self', 'ghost me', 'respond as me', and 'my AI twin' are broad and likely to occur in ordinary conversation, increasing the chance of accidental invocation. In this skill's context, accidental activation is especially risky because it deals with identity emulation, persistent monitoring, and drafting messages in the user's voice.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill description promotes always-on monitoring of email, calendar, Slack, WhatsApp, Signal, and Telegram and building a persistent style profile, but it does not prominently disclose the privacy implications of ingesting highly sensitive communications data. Because the entire purpose is cross-channel surveillance and impersonation assistance, missing warnings materially increase the risk of uninformed consent and unsafe deployment.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill omits a clear upfront warning that it may send messages on the user's behalf without approval for
PRIORITY_SENDERS. Automatic outbound communication under a user's identity is highly sensitive and can cause reputational, legal, and confidentiality harm if the profile, sender classification, or context is wrong.- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The Gmail monitor is explicitly authorized to send emails directly on behalf of the user for priority senders without human approval. In this skill's context, that creates autonomous outbound impersonation risk: prompt mistakes, compromised config, or adversarial emails could trigger unauthorized responses that damage trust, leak information, or commit the user to actions.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill description suggests one-click approval routing, but the channel instructions permit direct autonomous replies for some categories, creating a mismatch between expected oversight and actual behavior. That discrepancy increases the chance users grant sensitive access under the assumption of review-gated operation while the agent can in fact act independently.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction to conceal AI identity is a direct deception concern, especially in a skill expressly designed to act as the user's digital twin. Hiding automation from message recipients can facilitate impersonation, erode trust, and make downstream social-engineering attacks more effective because recipients believe they are interacting with the real person.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs reading and writing local files such as
ghostty/voice-profile.md,config.md,pending-drafts.md, andsent-log.mdbut declares no explicit tool scope or permissions. That mismatch weakens reviewability and least-privilege controls, making it easier for a user to invoke a skill that accesses sensitive communication-derived data without clear consent boundaries.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 97% confidence
- Finding
The safety section explicitly allows sending without approval for
PRIORITY_SENDERS, which is autonomous decision-making under the user's identity. In a skill designed to emulate the user's voice across personal and professional channels, a mistaken or manipulated auto-send could disclose sensitive information, create binding commitments, or damage trust and reputation.- Content
md ## Safety - Ghostty never sends without approval UNLESS the sender is in PRIORITY_SENDERS - All sent drafts are logged in `ghostty/sent-log.md` - DND hours from `ghostty/availability.md` are respected — no pings during sleep hours - Review `ghostty/pending-drafts.md` at least once daily
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document instructs operators to store raw Gmail and calendar OAuth secrets in local
.envfiles under the skill directory, which creates a concentrated credential target and encourages insecure secret handling. In a skill designed for always-on multi-channel monitoring, compromise of those files could grant persistent access to email and calendar accounts and enable account takeover-like actions.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The setup instructions reference storage of sensitive OAuth tokens and credentials without a corresponding warning about the risks of handling full-account access material. Because these credentials enable broad access to communications and scheduling data, users need explicit guidance on sensitivity, storage, and compromise impact.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file authorizes direct autonomous sending but does not pair that with a clear user-facing warning about outbound actions performed in the user's name. In this context, lack of disclosure is security-relevant because users may underestimate the operational and reputational risk of granting channel access to an always-on proxy.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The WhatsApp monitor is told to avoid revealing that it is an AI unless directly asked, which enables covert impersonation of the user in private communications. In a digital-self skill whose purpose is to mimic the user's voice across channels, concealment materially raises deception, consent, and social-engineering risks.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The calendar monitor goes beyond reminders and is authorized to modify participation state by auto-accepting invites for priority senders. That means the agent can make scheduling commitments on the user's behalf, and errors or manipulation of sender priority could create real-world conflicts, missed obligations, or unwanted disclosure of availability patterns.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly permits automatic external actions such as direct message sending, auto-accepting meeting invites, and declining invites without requiring a clear user confirmation or warning about downstream effects. In the context of an always-on 'digital self' that acts across multiple communication channels, this creates a real risk of unauthorized communications, accidental commitments, reputation damage, and calendar manipulation at scale.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The sent-log format stores subject excerpts plus full outgoing message bodies in a persistent markdown file without any privacy notice, minimization rule, or retention control. Given this skill's purpose of monitoring personal communications and imitating the user across email, chat, and messaging apps, such logs can accumulate highly sensitive personal, business, and relationship data that would be exposed if the workspace, agent storage, or downstream tools are compromised.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This documentation instructs users to analyze folders of sent emails and message exports, which commonly contain highly sensitive personal, professional, and third-party data, but it provides no privacy, consent, minimization, retention, or local-processing warnings. In the context of a skill explicitly designed to build a persistent writing-style profile across multiple communication channels, that omission increases the likelihood of over-collection, inappropriate ingestion of private data, and downstream leakage of contacts' information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This script ingests private communications from email, chat, and messaging exports and writes a derived voice-profile file without any consent prompt, privacy notice, minimization controls, or safeguards against including identifying phrases from the source data. Even though it does not exfiltrate data itself, it normalizes large-scale processing of sensitive personal content into a persistent artifact that could later be misused, leaked, or fed to downstream systems for impersonation.
- Content
Static analysis
No suspicious patterns detected.