Security audit

Architect Assistant

Security checks for vulnerabilities and agentic risk

Overview

This architecture assistant is useful in purpose, but it installs persistent passive monitoring and scheduled jobs that can silently record sensitive project, client, and payment details.

Review this skill carefully before installing. It can be useful for an architect who wants a persistent project assistant, but only install it if you are comfortable with automatic workspace notes, client/payment/project details being stored in Markdown files, a persistent AGENTS.md rule affecting future conversations, and scheduled background runs. Prefer a version that makes passive capture and cron jobs explicit opt-in features and provides clear disable and deletion instructions.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:18
Finding: Persistent Cross-Conversation Behavior Injection Through AGENTS.md
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:114
Finding: Automatic Installation of Recurring Scheduled Tasks
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:46
Finding: Silent Plaintext Retention of Sensitive Client and Commercial Information
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The first-run flow creates and modifies multiple workspace files, including project files, sources, and agent configuration, without an upfront safety notice or explicit confirmation for each persistent change. Even if intended for setup convenience, this can lead to unexpected state changes and wider-than-expected persistence in the user's environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs modification of a global workspace/AGENTS.md so the architect behavior runs passively during every conversation, expanding its authority beyond explicit user invocation. This creates a cross-session persistence mechanism and silent data-capture surface that can affect unrelated conversations and tasks, which is dangerous even if framed as convenience.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: By appending a directive to run project-capture behavior during every conversation, the skill establishes persistent passive collection of user-provided project details. This is especially risky because the capture is broad, not limited to explicit /architect use, and can silently collect sensitive client, payment, schedule, and team information from unrelated chats.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill directs unattended cron-based execution for digest, check-in, and research tasks, enabling autonomous actions without per-run user approval. While partly aligned with the assistant's productivity purpose, scheduled background execution can trigger unexpected data access, external research, and message generation outside active user control.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The behavioral rules require continuous, invisible recording of conversation details into canonical project files, including client decisions, payment updates, blockers, and deadlines. The combination of stealth, persistence, and business-sensitive data collection makes this a genuine privacy and integrity risk, especially in a professional architecture context where conversations may include confidential client and project information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill tells itself to automatically update project files based on conversation signals and to 'be invisible,' meaning user data is modified silently without a clear confirmation boundary. Silent writes to canonical project records risk inaccurate logging, privacy violations, and durable corruption of business/project data from ambiguous conversational statements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guideline states that the digest file is always written in English, which imposes a language policy regardless of the user's preferences. This is a natural-language policy concern because the skill does not offer a language choice or obtain user opt-in for the forced locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The language section states that drafted message language depends on the recipient, not the user's preference. This imposes a language/locale rule without explicit user opt-in or a clear choice mechanism, which matches the policy-violation category for forced language behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guideline says the findings log is always written in English, which imposes a language policy regardless of the user's preferred language. Because the file does not present this as an opt-in choice or explain a necessary regional/compliance reason, it matches the policy-violation criterion for forced language or locale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The template explicitly solicits and structures sensitive client and project information, including contact details, communication preferences, decision history, payment status, materials shared, and freeform notes, but provides no guidance on data minimization, consent, retention, or secure handling. In an architecture practice context, these fields can accumulate confidential business, personal, and commercial information that could be exposed, overshared, or retained longer than necessary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The procedure instructs the agent to modify persistent project records by updating the check-in date and appending the user's response, but it does not tell the agent to notify the user or obtain confirmation before writing. In a personal project-tracking skill this is likely intended behavior, but silent persistence of user input can still create privacy, consent, and data-integrity risks if the user does not realize their response will be stored.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The procedure explicitly instructs the agent to append a summary to the project's Notes section, which is a state-changing file modification, but it does not require notifying the user or obtaining consent at the time of the write. In an agent skill that works across project files and passive context capture, silent writes can create integrity and auditability issues, especially if the summary is inaccurate, premature, or unwanted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The procedure instructs the skill to write findings to workspace/digests/YYYY-MM-DD.md, which is a file-modifying operation. The document does not include any warning, confirmation, or user-facing disclosure that running the procedure will create or update files in the workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This markdown procedure instructs the skill to read from workspace/projects/ and USER.md, including communication history, payment status, and relationship details, which may contain sensitive personal or business information. While the file explains the operational steps, it does not warn the user that private project data and profile preferences will be accessed as part of drafting.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The procedure directs the agent to modify project files by appending findings, but it does so silently and without an explicit user-facing disclosure or consent checkpoint. In a workspace-oriented skill that performs research and logging, hidden writes can surprise users, create unwanted record changes, and normalize background state mutation without clear authorization boundaries.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.