T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:10- Finding
Excessive Proactive Access and Sensitive-Data Collection Across Connected Services
- Content
View full analysis
- Remediation
View remediation
Security audit
Exec Gilles
Security checks for vulnerabilities and agentic risk
Overview
This is a tailored executive-assistant skill, but it asks for broad private-data access and direct calendar/task changes without enough consent, scoping, or retention controls.
Install only if you intentionally want a highly proactive assistant with access to private email, messages, files, calendars, and tasks. Before use, restrict accounts and folders, require confirmation for deletions/modifications and any sending, remove hardcoded personal identifiers, and add clear retention and deletion controls for logs and extracted message content.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:10- Finding
Autonomous Destructive and State-Changing Actions Without Confirmation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs proactive scanning of Gmail, WhatsApp, Google Drive, and user files without any explicit consent boundary, warning, or minimization rule. In this context, the agent is encouraged to pull sensitive information from multiple private sources beyond a user’s immediate request, creating a substantial privacy and over-collection risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file-scanning section directs routine inspection of Google Drive and local or synced documents to extract operationally useful information, including potentially sensitive career, client, and personal data. Because this inspection is proactive and broad rather than user-scoped, it increases the chance of unnecessary exposure and retention of confidential content.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill instructs the agent to proactively seek out and extract sensitive information from private files and messages, including job-search materials, client briefs, and personal communications, without waiting for direct user requests. This is dangerous because it normalizes surveillance-like behavior and encourages collection of more data than is necessary to fulfill a specific task.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill mandates proactive monitoring of WhatsApp conversations and recent emails to detect commitments, unanswered messages, and urgency signals without a clear communications-monitoring disclosure. Continuous or default analysis of private communications is highly sensitive and can expose personal, professional, and third-party data well beyond what is needed for the immediate task.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill requires broad retention and logging of tasks, commitments, decisions, message content, and extracted data across email, WhatsApp, and files under a 'mémoire totale' model. Comprehensive cross-source retention increases the blast radius of any compromise, leaks sensitive user and third-party information, and conflicts with data-minimization principles.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text gog gmail send --to "destinataire@email.com" --subject "Sujet" --body "Corps du message"Tu ne crées JAMAIS de fichier Python. Tu n'utilises JAMAIS credentials.json. Tu n'utilises JAMAIS l'API Google directement. La commande gog ci-dessus est la SEULE méthode autorisée.
La syntaxe complète et obligatoire pour envoyer un email : gog gmail send --account gilles.harpoutian@gmail.com --to "destinataire@email.com" --subject "Sujet" --body "Corps du message"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill authorizes the agent to create, modify, and delete calendar events and tasks directly, but does not require confirmation for destructive actions or warn the user about autonomous changes. This can cause loss of scheduling integrity, accidental deletions, and unauthorized changes if the skill misinterprets context or is prompted maliciously.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instructions are written to require a fixed communication style in French, including mandatory informal address, with no indication that the user may choose another language or locale. This is a natural-language policy concern because it imposes a language/locale preference without explicit opt-in or justification as a region-specific tool.
- Content
Static analysis
No suspicious patterns detected.