Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed workspace cleanup helper that inventories generated files and requires user confirmation before archiving or deletion.
Install only if you want an agent to help inventory and clean generated workspace artifacts. Review the proposed paths before approving archive or deletion actions, and treat reports as potentially sensitive because they can include local project paths and filenames.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
"should_trigger": true
},
{
"query": "Clean up agent-generated logs and screenshots. Do not touch databases or .env files.",
"should_trigger": true
},
{
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
"should_trigger": true
},
{
"query": "Clean up agent-generated logs and screenshots. Do not touch databases or .env files.",
"should_trigger": true
},
{
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
PROTECTED_NAMES = {
".git",
".env",
".env.local",
".env.production",
".env.development",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
PROTECTED_NAMES = {
".git",
".env",
".env.local",
".env.production",
".env.development",
"id_rsa",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
".git",
".env",
".env.local",
".env.production",
".env.development",
"id_rsa",
"id_ed25519",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
".env",
".env.local",
".env.production",
".env.development",
"id_rsa",
"id_ed25519",
}
The skill explicitly instructs the agent to run shell commands and read workspace contents, but it does not declare any tool scope such as permissions or allowed-tools. That creates an authorization gap where a host system may permit broader command execution or file access than the skill actually needs, increasing the chance of unintended workspace inspection or destructive cleanup actions if the skill is invoked.
Several positive trigger examples use broad, natural phrases such as 'Help me identify temporary files' and 'Before handoff, tidy the workspace' that can overlap with ordinary repository-assistance requests. In a trigger-eval file, this can train or validate the skill to activate too eagerly, causing unintended cleanup-oriented behavior in contexts where the user did not clearly request workspace artifact inventory or archiving.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_git(root: Path, args: list[str]) -> str | None:
try:
result = subprocess.run(
["git", "-C", str(root), *args],
check=False,
stdout=subprocess.PIPE,
The script emits detailed workspace paths, filenames, modification times, git status, and size information in JSON/report output. In an agent skill context, that metadata can expose sensitive local project structure, ignored files, secret-adjacent filenames, or private artifacts to downstream consumers or logs even though file contents are not read.
No suspicious patterns detected.