Janitor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:22 PM UTC
• Version: 1.0.0

Overview

This maintenance skill is not malicious, but it gives broad cleanup and sensitive workspace-inspection authority that users should review before installing.

Install only if you are comfortable with a maintenance agent reading memory/configuration files and moving or deleting workspace files after archival. Prefer using it with explicit per-run instructions, dry-run review, path allowlists, and a rule not to read or copy secret values from TOOLS.md or other credential stores.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:22
• Finding: Overly Broad Access to Sensitive Workspace State and Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 22-33 and 68-69 **Vulnerability Type**: Excessive access to memory, credential-related configuration, and agent configuration **Risk Level**: Medium ### Vulnerable Code ```markdown ## Daily Checks - [ ] Memory files from past 3 days — anything to consolidate into MEMORY.md? - [ ] Artifact dirs — anything older than 7 days that can archive? - [ ] Research files — leads older than 30 days flagged as stale? - [ ] HEARTBEAT.md — still reflects current priorities? - [ ] TOOLS.md — API keys and configs still accurate? ## Weekly Deep Clean - [ ] Archive memory files older than 7 days to `memory/archive/` - [ ] Update MEMORY.md with distilled learnings from daily notes - [ ] Refresh stale research (flag for Scout re-search) - [ ] Check for orphaned files (generated/ artifacts/ tmp/) - [ ] Verify all agent skill configs match current reality ``` ```markdown 2. Scan workspace against checklists 3. Execute cleanup actions ``` ### Technical Analysis The skill instructs the agent to inspect long-term memory, `TOOLS.md`, and all agent skill configurations. `TOOLS.md` is explicitly described as containing API-key and configuration information. These resources are substantially more sensitive than ordinary cleanup targets. The instructions do not define a path allowlist, credential-redaction requirements, read-versus-write boundaries, or approval controls for agent-configuration changes. Consequently, a maintenance invocation may place credential values and private memory into the agent context. Because the workflow also updates `MEMORY.md` and creates maintenance reports, sensitive information observed during scanning could potentially be copied into persistent files. This breaks least-privilege principles: validating whether configuration is current generally requires metadata or status checks, not unrestricted access to secret values or authority to modif ...[truncated 1350 chars]
• Remediation: ## Remediation Suggestions 1. Define an explicit allowlist of directories and files the skill may inspect. 2. Prohibit reading or reporting API-key values, tokens, passwords, private keys, and other secret fields. 3. Validate credential configuration through presence, expiry metadata, or dedicated secret-management APIs rather than opening plaintext values. 4. Add mandatory redaction before writing `MEMORY.md` or maintenance reports. 5. Separate read-only auditing from mutation operations and require explicit user approval before changing agent configurations. 6. Restrict report permissions and ensure reports contain file names and status information rather than file contents. 7. State explicitly that `TOOLS.md`, credential stores, and unrelated agent configurations are out of scope unless the user authorizes each target.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29
• Finding: Insufficiently Scoped Archival and Deletion Policy## Vulnerability Details **File Location**: `SKILL.md`, lines 29-34, 68-69, and 79-84 **Vulnerability Type**: Unsafe file mutation and cleanup configuration **Risk Level**: Medium ### Vulnerable Code ```markdown - [ ] Archive memory files older than 7 days to `memory/archive/` - [ ] Update MEMORY.md with distilled learnings from daily notes - [ ] Refresh stale research (flag for Scout re-search) - [ ] Check for orphaned files (generated/ artifacts/ tmp/) - [ ] Verify all agent skill configs match current reality - [ ] Clean up empty or abandoned artifact dirs ``` ```markdown 2. Scan workspace against checklists 3. Execute cleanup actions ``` ```markdown ## Success Criteria - Workspace passes all daily check items - No files older than 30 days in active directories (archived or deleted) - MEMORY.md reflects last 7 days of significant events - Zero orphaned or tmp files in workspace root ## Don't - Don't delete anything without archiving first (trash > rm) ``` ### Technical Analysis The skill treats file age, apparent orphan status, empty directories, and temporary-file classification as grounds for moving or deleting workspace content. However, it does not define precise directory boundaries, reliable orphan-detection rules, retention exceptions, archive collision handling, symlink behavior, rollback procedures, or mandatory confirmation. The requirement that no file older than 30 days remain in active directories is particularly broad. File age does not establish that a file is obsolete, and files that appear orphaned to the maintenance agent may still be consumed by external tools or active workflows. Archiving before deletion reduces permanent-loss risk but does not prevent broken references, archive overwrites, permission changes, or operational disruption. The instruction to execute cleanup actions directly also omits a required dry-run phase in which a human can review the planned mutations. ...[truncated 1207 chars]
• Remediation: ## Remediation Suggestions 1. Replace workspace-wide cleanup rules with strict allowlisted paths and file types. 2. Make every cleanup run produce a dry-run manifest containing the source path, proposed destination, reason, file age, and file size. 3. Require explicit user approval before deletion, configuration modification, or movement of files outside dedicated disposable directories. 4. Define protected files and directories that must never be moved automatically. 5. Use collision-safe archive names, preserve metadata, and record checksums and original paths in a restoration manifest. 6. Do not follow symbolic links during scans or cleanup, and verify that resolved paths remain under the approved workspace root. 7. Replace age-only deletion criteria with project-specific retention policies and evidence that a file is unreferenced. 8. Implement atomic moves, error handling, audit logs, and a tested rollback procedure. 9. Apply separate policies to memory, artifacts, generated files, and temporary files rather than a single global age threshold.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: L12 says "Janitor MAINTAINS, doesn't create or review," implying it should not author new content. However, L36-L57 provide a report template and L70/L74-L75 instruct the skill to write maintenance reports to artifacts/janitor/, which is active content creation and contradicts that statement.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: L30 directs the skill to "Update MEMORY.md with distilled learnings from daily notes," which is content creation/modification. That conflicts with the explicit instruction at L85, "Don't modify content files (that's Scribe's domain)," creating a direct documentation-level contradiction about whether Janitor edits substantive content.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill authorizes archival, cleanup, and deletion-oriented maintenance actions across the workspace without a prominent user warning or stronger approval gate. In an autonomous or scheduled context, this increases the risk of unintended data movement or loss, especially because the success criteria encourage removing old files from active directories and the workflow includes executing cleanup actions.