workspace-organizer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:14 AM UTC
• Version: 2.0.0

Overview

The skill mostly matches its stated workspace organization and memory purpose, but its file-writing scripts do not safely constrain task and step names, which can let operations escape the intended task area and corrupt recovery data.

Review before installing. Use only trusted, simple task and step names, avoid values containing slashes, backslashes, drive prefixes, or '..', and avoid the PowerShell fallback until metadata preservation and path containment are fixed. Enable the heartbeat template only if recurring recovery checks are desired.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/safe-writer.py:141

Finding

Workspace Path Traversal Through Unsanitized Task and Step Identifiers

Content

View full analysis

Remediation

View remediation

Path: validate_component(component, "path component") resolved_base = base.resolve() candidate = (resolved_base / component).resolve() try: candidate.relative_to(resolved_base) except ValueError: raise ValueError("Path escapes the permitted workspace") return candidate ``` 3. Apply containment validation separately to: - Task identifiers - Step directory names - Metadata read paths - Metadata write paths 4. Reject absolute paths, drive-qualified paths, `.` and `..`, path separators, null bytes, and alternate separator forms before filesystem access. 5. Account for symbolic-link traversal. Validate the resolved parent directory immediately before reading, creating, or replacing the target. 6. Implement equivalent canonicalization in PowerShell: - Obtain the fully resolved candidate path. - Obtain the fully resolved output root. - Verify that the candidate is a descendant of the output root using a separator-aware comparison. - Reject the operation if containment cannot be established. 7. Add automated tests covering Unix and Windows traversal forms, absolute paths, drive prefixes, UNC paths, mixed separators, and symbolic-link escapes. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/safe-writer-ps1.txt:143

Finding

PowerShell Fallback Destructively Replaces Existing Task Metadata

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The skill claims a timestamp-folder creation capability, but the visible content mainly describes memory and metadata management rather than clearly implementing the advertised file-organization function. Overstating one function while under-describing other persistent storage actions creates a trust and review gap that can hide unintended data handling.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence

Finding

The skill claims a timestamp-folder creation capability, but the visible content mainly describes memory and metadata management rather than clearly implementing the advertised file-organization function. Overstating one function while under-describing other persistent storage actions creates a trust and review gap that can hide unintended data handling.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill instructs use of shell commands and scripts that can read environment state and write files, but it does not declare any tool scope or permissions boundary. This makes the skill harder to sandbox and review, and increases the chance it will be invoked with broader capabilities than intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language content, including the manifest description, triggers, and operating instructions, is entirely in Chinese, while the file title is English and no user opt-in or locale justification is provided. This can violate language or locale policy because the skill implicitly requires a specific language for invocation and use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases are broad everyday requests such as organizing files or saving progress, which can cause the skill to activate in situations the user did not intend. For a skill that writes files and invokes scripts, accidental invocation can lead to unreviewed state changes across the workspace.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire skill content is written in Chinese and does not indicate any option for the user to choose another language or locale. Under the policy rule, enforcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire guide, including headings, task metadata examples, statuses, and command argument examples, is written exclusively in Chinese with no indication that other languages are supported. This can violate language/locale policy when a skill implicitly requires a specific language without user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all guidance in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language description in the script is written only in Chinese and presents the tool identity/instructions in that language, with no indication that other languages are supported or that the user can opt in to a locale. Per the policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code presents its description and user-facing messages in Chinese, starting with the module docstring, and continues that pattern throughout the script. The file provides no option for user language selection and no documented justification that the skill is intended only for a Chinese-language environment, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's primary human-facing description is written only in Chinese, and the CLI help/messages throughout the file are also Chinese-only. This imposes a specific language on users without any opt-in or alternative locale handling, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

init_task uses untrusted task_id and steps directly in filesystem path construction (self.output_dir / task_id, task_dir / step.strip()) without validating that the resolved paths remain under the intended workspace directory. An attacker can supply path traversal values such as ../ or absolute paths to create directories and metadata files outside the managed task area, potentially overwriting or planting files elsewhere on the host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

add_memory_point builds meta_file = self.output_dir / task_id / '.task-meta.json' from attacker-controlled task_id and then reads and rewrites that file with no containment check. This enables path traversal to target arbitrary .task-meta.json files outside the workspace and, if such a file exists, modify its contents, causing unauthorized file tampering and possible corruption of unrelated application state.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/task-recovery-check.py (reported line 70)May include surrounding context.

python

try:
        # Run scan command
        result = subprocess.run(
            ['py', str(manager_script), 'scan'],
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script hard-codes Chinese status values (进行中, 已暂停) and user instructions (恢复上次任务) without offering any language or locale choice. This can force a specific language experience on users and create a natural-language policy issue where language selection is not user-driven or explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The auto-recover mode restores task state automatically based on discovered active tasks, with no confirmation, trust boundary check, or warning about what content will be loaded. In a workspace/memory-management skill, loading prior task state can reintroduce untrusted instructions or stale context into a new session, increasing the chance of prompt/state injection and unintended actions.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 79% confidence

Finding

This subprocess call passes latest_task, which is parsed from another script's stdout, into a state-loading command without validation or user confirmation. While list-based argument passing prevents shell injection, it can still trigger unintended recovery/loading behavior or argument confusion if the upstream output is malformed or attacker-controlled within the workspace context.

Content

Scanner excerpt · scripts/task-recovery-check.py (reported line 119)May include surrounding context.

python

if active_tasks:
                latest_task = active_tasks[0]['task_id']
                print(f"\nINFO: Auto-recovering: {latest_task}")
                subprocess.run([
                    'py', str(manager_script), 'load', 
                    '--task-ids', latest_task,
                    '--max-per-task', '5'

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The comment 'Workspace Organizer quick commands (English)' indicates an English-only language constraint. There is no nearby opt-in, alternative locale support, or justification that this skill is region-specific, so it appears to impose a specific language without user choice.

Content

No source excerpt is available for this finding.