Workspace Indexer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:18 AM UTC
• Version: 1.0.0

Overview

This skill is a transparent workspace indexer, but it combines memory access, shell execution, service/container discovery, recurring automation, and persistent workspace writes without enough scoping or confirmation.

Install only if you are comfortable with the agent searching persistent memory, inspecting workspace/runtime status, and writing a durable WORKSPACE_INDEX.md. Prefer using it manually, review the generated file before committing or syncing it, and avoid enabling daily automation unless you add overwrite checks, redaction, and clear workspace-scope limits.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:11

Finding

Unnecessary Access to Persistent Agent Memory and Replication of Memory Metadata

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11-12 and SKILL.md:29-30
Vulnerability Type: Excessive access to persistent Agent memory
Risk Level: Medium

Vulnerable Code Snippet

SKILL.md:11-12:

markdown

### 1. 搜索记忆
首先使用 `memory_search` 搜索每个目录的相关记忆，了解目录用途和历史。

English translation:

markdown

### 1. Search Memory
First use `memory_search` to search for memories related to each directory and understand its purpose and history.

SKILL.md:29-30:

markdown

### 5. 生成索引
写入 `WORKSPACE_INDEX.md`，格式参考以下示例：

English translation:

markdown

### 5. Generate the Index
Write the results to `WORKSPACE_INDEX.md` using the following example format:

The examples at SKILL.md:34-50 direct the generated index to include related memory filenames and search keywords.

Technical Analysis

The skill requires memory_search and instructs the Agent to search persistent memory for every indexed directory. It then generates a workspace-level file containing directory descriptions, related memory references, and search keywords.

Basic directory indexing does not inherently require access to conversation-derived or long-term Agent memory. Combining workspace enumeration with persistent memory access expands the skill beyond the least privilege necessary for its primary task. It also creates a secondary artifact, WORKSPACE_INDEX.md, that can expose derived memory metadata to users or processes that cannot directly query the memory system.

The reviewed instructions do not explicitly request credentials or full memory contents. Nevertheless, memory filenames, project associations, historical context, and effective search terms may themselves be sensitive and can facilitate subsequent discovery.

Attack Path

1. A user or scheduled heartbeat triggers the workspace index update.
2. The skill invokes memory_search for each discovered directory.
3. Search results ...[truncated 1073 chars]

Remediation

View remediation

Remediation Suggestions

1. Make persistent memory integration opt-in and disabled by default.
2. Ask for explicit user authorization before searching memory for workspace directories.
3. Restrict searches to approved, non-sensitive memory namespaces or files.
4. Do not write memory filenames, dates, raw search terms, or conversation-derived details into WORKSPACE_INDEX.md by default.
5. Add redaction rules for credentials, personal information, internal hostnames, confidential project names, and operational data.
6. Store only a minimal directory-purpose summary when memory use is authorized.
7. Apply restrictive permissions to the generated index and exclude it from source control or external synchronization where appropriate.
8. Document the exact memory fields that may be read and persisted.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:14

Finding

Overprivileged Command Execution for Workspace and Runtime Reconnaissance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14-15, SKILL.md:23-27, and skill.json:7
Vulnerability Type: Excessive command-execution permissions and environment reconnaissance
Risk Level: Medium

Vulnerable Code Snippet

SKILL.md:14-15:

markdown

### 2. 扫描目录
使用 `exec` 工具扫描 workspace 目录结构。

English translation:

markdown

### 2. Scan Directories
Use the `exec` tool to scan the workspace directory structure.

SKILL.md:23-27:

markdown

### 4. 收集信息
对每个目录：
- 读取 README 或注释（如果有）
- 检查是否有运行中的服务或容器
- 不要深入分析项目内部文件

English translation:

markdown

### 4. Collect Information
For each directory:
- Read the README or comments, if present.
- Check whether services or containers are running.
- Do not deeply analyze files inside the project.

skill.json:7:

json

"requiredTools": ["exec", "memory_search", "read", "write"]

Technical Analysis

The skill requires the general-purpose exec tool merely to enumerate workspace directories. It also instructs the Agent to inspect running services and containers. A directory index can be generated using workspace-confined file-listing and read operations, so unrestricted shell execution and runtime-service reconnaissance exceed the minimum permissions required.

Depending on the Agent environment, exec may permit arbitrary command execution under the Agent process account. The reviewed skill does not contain a command-injection payload or explicit destructive command. The risk instead arises from granting a broad execution capability to a prompt-based indexing workflow, where ambiguous instructions or malicious workspace content could influence command selection.

Runtime inspection can also reveal container identifiers, service names, exposed ports, process state, and deployment topology. The examples in SKILL.md encourage including such details in the generated index, creating a durable ope ...[truncated 1686 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from requiredTools and use a read-only, workspace-confined directory-listing API.
2. Restrict traversal to the configured workspace root and reject symlink traversal outside that root.
3. Remove service, process, port, and container enumeration from the default indexing workflow.
4. If runtime inspection is necessary, require explicit user consent for each run and use narrowly scoped, read-only APIs.
5. Do not include container IDs, process identifiers, internal hostnames, or listening ports in the generated index unless specifically requested.
6. Apply an allowlist of permitted operations rather than exposing a general shell.
7. Never interpolate directory names, filenames, README content, or memory-search results into shell commands.
8. Run any permitted scanner under a sandboxed, unprivileged account with filesystem and network restrictions.
9. Record which metadata was collected and provide the user with a preview before writing WORKSPACE_INDEX.md.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README states that the skill generates WORKSPACE_INDEX.md in the workspace root but does not clearly warn users that an existing file may be created or overwritten. In an automated or daily-maintenance context, this can lead to unintended modification or loss of user-authored content, especially if the filename already exists for another purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs the agent to write or overwrite WORKSPACE_INDEX.md in the workspace, but it provides no user-facing warning, confirmation step, or scope guard for modifying files. In an automated agent setting, this creates an unauthorized file-modification pathway that could change repository/workspace state, overwrite existing content, or cause unintended persistence of generated data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill recommends adding a daily maintenance task in HEARTBEAT.md to automatically update the workspace index, which normalizes recurring file modifications without any warning, approval gate, or change controls. This increases risk because repeated autonomous writes can silently alter user files over time, propagate stale or sensitive environment details, and make unauthorized persistence harder to notice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description says the skill will 'automatically maintain' a workspace index with 'intelligent recursion,' which suggests broad autonomous behavior without explicit user-trigger or scope limits. In a skill that also requests exec, read, write, and memory_search, vague auto-activation language increases the risk of unbounded filesystem traversal, unintended data collection, and modification of workspace contents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The README includes automation instructions and headings in Chinese for the HEARTBEAT.md setup, which may impose a locale-specific usage pattern. There is no indication that language is optional or that the skill is intentionally limited to a Chinese locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.