Security audit

WorkBuddy月度体检·对话复盘

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because its private-conversation access is insufficiently scoped and it requires unrelated advertising in its results.

Before installing, require a clear choice of month, projects, recurring execution, and output locations. Remove the mandatory advertising and account for sensitive full-transcript copies. The supplied code shows local reading and writing, with no demonstrated exfiltration or destructive behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The mandatory promotional footer is a supported mismatch: it directs the assistant to advertise an external community regardless of relevance to the requested conversation audit. This contaminates trusted assistant output and can steer users to an unassessed external site; however, the supplied file does not substantiate the finding's additional claims about transcript-export implementation or writes beside source files.
Content: No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Generic monthly-review triggers can activate a full conversation audit unintentionally.

Medium

Category: Trigger Abuse
Confidence: 92% confidence
Finding: Broad triggers such as 'monthly review' can match requests that do not authorize inspection of private conversation history. Coupling these triggers with instructions to read the full archive, without a confirmation step, creates a plausible unintended-access path, though actual activation depends on the host's skill-selection behavior.
Content: No source excerpt is available for this finding.

Automatic analysis of the full conversation archive lacks a privacy warning.

Medium

Category: Output Handling
Confidence: 88% confidence
Finding: The substantive issue is unrestricted archive processing and creation of sensitive behavioral summaries without an explicit consent or minimization step, rather than merely a missing warning. Although conversation analysis is the skill's stated purpose, automatically reading the full archive can include unrelated projects, third-party information, or material outside the requested month; no external exfiltration is demonstrated.
Content: No source excerpt is available for this finding.

The skill mandates unrelated promotional content in every output, beyond its declared monthly conversation-audit purpose.

Medium

Category: Excessive Agency
Confidence: 99% confidence
Finding: The instruction to append author promotion to every output redirects the assistant beyond the user's audit request. The external invitation can inherit credibility from the assistant's report, although there is no evidence here of malicious destination content or automatic data transmission.
Content: No source excerpt is available for this finding.

The skill requires every output to include unrelated author promotion and an external community invitation.

Medium

Category: Prompt Injection
Confidence: 99% confidence
Finding: The compulsory community invitation uses the audit workflow to distribute unrelated promotional content and direct users to an external destination. This is the same underlying output-hijacking issue reported by SDI-1, not an additional independent vulnerability, and the URL alone does not establish phishing or data theft.
Content: No source excerpt is available for this finding.

The conversation exporter appends unrelated advertising and an external community invitation to its output.

Low

Category: Excessive Agency
Confidence: 99% confidence
Finding: The exporter appends unsolicited advertising and an external community invitation to normal command output, creating a low-severity output-integrity issue if an agent incorporates that output into its response or monthly report. The promotion is unrelated to conversation auditing and could appear implicitly endorsed, but the code neither transmits conversation data to the URL nor automatically opens it; the apparent intent is marketing rather than demonstrated malicious activity.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.