Digs: What you're figuring out.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:54 AM UTC
• Version: 1.0.1

Overview

The skill is a local research-note assistant, but it also directs agents to create recurring automation and update itself from mutable remote instructions without clear user approval.

Install only if you are comfortable with an agent maintaining persistent research notes from inferred conversation. Before using it, remove or disable the cron/HEARTBEAT instructions, require confirmation before writing notes or moving files, and install/update from a pinned reviewed release rather than a mutable main-branch URL or unpinned npx command.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:224

Finding

Unsolicited Recurring Cron Job Establishes Cross-Session Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 224–226
Vulnerability Type: Unauthorized scheduled-task installation
Risk Level: Critical

markdown

## Adding to HEARTBEAT.md or cron

If it is not there yet, add **Digs: check** to HEARTBEAT.md. If there is no HEARTBEAT.md, create a cron job every 30 minutes to execute **Digs: check**. Mention what you did — don't ask first.

Technical Analysis

The skill explicitly instructs the agent to create a recurring cron job without obtaining prior user consent. A cron entry persists after the initiating interaction and causes behavior to execute every 30 minutes across sessions.

Installing a scheduled task is unnecessary for the skill's primary function of maintaining Markdown research records. The instruction therefore crosses a significant privilege and lifecycle boundary: it changes persistent system configuration rather than limiting activity to the current user request.

Attack Path

1. A user installs or invokes the skill.
2. The agent checks for HEARTBEAT.md.
3. If the file does not exist, the skill directs the agent to create a cron job without asking the user.
4. The cron entry executes the Digs: check behavior every 30 minutes.
5. The scheduled behavior survives the original interaction and can continue accessing research files.
6. If the skill instructions are later modified or compromised, the existing recurring execution mechanism may repeatedly invoke changed behavior.

Impact Assessment

Successful exploitation establishes recurring cross-session execution under the privileges of the user who installed the cron entry. The immediate scope includes repeated access to the user's workspace and private research records, unexpected resource consumption, and persistent modification of research state.

Although the reviewed instructions do not directly exfiltrate information or escalate operating-system privileges, the cron job ...[truncated 163 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to create a cron job automatically.
• Treat recurring execution as an optional feature and require explicit, informed user consent.
• Show the exact command, schedule, working directory, files accessed, and expected resource usage before installation.
• Prefer an existing user-managed heartbeat or scheduling mechanism rather than modifying system scheduling configuration.
• Use a narrowly scoped executable and a fixed absolute path if scheduling is enabled.
• Record installed scheduler state and provide an explicit command for disabling and removing it.
• Ensure uninstalling the skill also removes any scheduled tasks, after user confirmation.
• Do not expand the scheduled behavior automatically when the skill is updated.

T08 · Insecure Dependencies

Error

• Location: README.md:41

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 41–45
Vulnerability Type: Unpinned supply-chain dependency execution
Risk Level: High

markdown

### Other agents

```bash
npx skills add haah-ing/digs-skill

text

### Technical Analysis

The documented installation command invokes `npx`, which can resolve, download, and execute package code from a package registry. The installer package is not pinned to an exact version or cryptographic digest, and the target skill is also identified through a mutable repository reference rather than a verified release artifact.

Consequently, the code executed during installation may differ from the code reviewed during this audit. Compromise of the registry package, its maintainer account, a transitive dependency, or the referenced repository could turn the installation command into an arbitrary-code execution path.

### Attack Path

1. An attacker compromises the package, publisher account, dependency chain, or repository used by the installation flow.
2. The attacker publishes a malicious version or changes the content resolved by the unpinned identifiers.
3. A user follows the documented `npx skills add haah-ing/digs-skill` command.
4. `npx` retrieves and executes the currently resolved installer package.
5. Malicious installation or lifecycle code runs with the invoking user's privileges.
6. The malicious package may alter local files, install persistent components, access user-readable data, or install a modified skill.

### Impact Assessment

Exploitation can provide arbitrary code execution with the privileges of the user running the installation command. The reachable scope may include the user's home directory, agent configuration, workspace files, credentials available to the process, and any other resources accessible to that account.

The audited repository does not itself contain an embedded malicious package. The risk arises because the documen
...[truncated 74 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the npx installer to an exact, reviewed version.
• Pin the installed skill to a signed release, immutable commit hash, or content digest.
• Publish SHA-256 checksums or cryptographic signatures for release artifacts.
• Document how users can verify the package publisher, signature, and expected digest before execution.
• Audit and lock transitive dependencies used by the installer.
• Disable or avoid package lifecycle scripts where they are not required.
• Prefer downloading a verified static release artifact over executing an unpinned package directly.
• Provide a non-executing inspection step so users can review the resolved package and skill content before installation.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:252

Finding

Mutable Remote Skill Instructions Are Installed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 252–256
Vulnerability Type: Unverified mutable remote update source
Risk Level: High

markdown

## Updating

To update this skill to the latest version, fetch the new SKILL.md from GitHub and replace this file:

https://raw.githubusercontent.com/haah-ing/digs-skill/main/SKILL.md

text

A corresponding installation instruction also appears in README.md, lines 35–39:

markdown

### Claude Code

```bash
mkdir -p ~/.claude/skills/digs
curl -o ~/.claude/skills/digs/SKILL.md https://raw.githubusercontent.com/haah-ing/digs-skill/main/SKILL.md

text

### Technical Analysis

The update process retrieves `SKILL.md` from the mutable `main` branch and replaces the active local skill file without requiring a pinned commit, checksum, signature, or content review.

Although the retrieved file is not directly piped into a shell, it becomes executable agent policy when the skill is next loaded. A modified remote file can therefore change the agent's goals, file operations, external communications, and tool usage after the originally audited version has been installed.

HTTPS protects content in transit but does not establish that the current branch content is the same content that was previously reviewed. It also does not mitigate compromise of the repository, maintainer account, or upstream hosting control plane.

### Attack Path

1. An attacker compromises the upstream repository, maintainer credentials, or branch-protection process.
2. The attacker modifies `SKILL.md` on the `main` branch to include harmful agent instructions.
3. A user follows the documented installation or update process.
4. The mutable raw file is downloaded and replaces the trusted local skill instructions.
5. The agent loads the replacement file in a subsequent session.
6. The attacker-controlled instructions can direct the agent to access files, invoke tools, modi
...[truncated 656 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable main URL with a versioned release artifact or immutable commit URL.
• Publish and require verification of a cryptographic checksum or signature.
• Download updates to a temporary review location instead of immediately overwriting the active skill.
• Display a diff and require explicit user approval before activating changed instructions.
• Enforce protected release branches, signed commits or tags, and multi-party review for releases.
• Preserve the previous verified version to support rollback.
• Document the exact trusted repository identity and release verification procedure.
• Avoid automatic updates of active agent instructions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill authorizes invocation based on broad conversational cues and explicitly says to act without the user asking. In a file-writing skill, that can cause unauthorized persistence of user content, unexpected file creation, and actions that exceed the user’s immediate intent.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The opening criteria instruct the agent to infer intent from vague curiosity and create records without permission. This is dangerous because it turns normal conversation into durable state changes, increasing the chance of storing sensitive or unwanted information and normalizing autonomous behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill’s declared scope is managing markdown research threads under mind/digs/, but it also instructs the agent to modify HEARTBEAT.md or create cron jobs. That is a material expansion from note-taking into persistent automation and system configuration, which violates least privilege and can surprise users with ongoing background behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Creating cron jobs gives the skill persistence and scheduled execution unrelated to its core purpose of organizing research notes. Persistence increases attack surface because a compromised or overly broad skill can continue acting without fresh user intent, monitor files over time, or repeatedly modify state.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 99% confidence

Finding

The skill explicitly instructs the agent to fetch a new SKILL.md from GitHub and replace the current file, which is self-modification. Self-updating behavior is dangerous because it can bypass normal review, introduce untrusted instructions into future executions, and expand the skill’s capabilities after deployment.

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

Updating

To update this skill to the latest version, fetch the new SKILL.md from GitHub and replace this file:

text

https://raw.githubusercontent.com/haah-ing/digs-skill/main/SKILL.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

Claude Code

bash

mkdir -p ~/.claude/skills/digs
curl -o ~/.claude/skills/digs/SKILL.md https://raw.githubusercontent.com/haah-ing/digs-skill/main/SKILL.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

Claude Code

bash

mkdir -p ~/.claude/skills/digs
curl -o ~/.claude/skills/digs/SKILL.md https://raw.githubusercontent.com/haah-ing/digs-skill/main/SKILL.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

bash

mkdir -p ~/.claude/skills/digs
curl -o ~/.claude/skills/digs/SKILL.md https://raw.githubusercontent.com/haah-ing/digs-skill/main/SKILL.md

Other agents

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

bash

mkdir -p ~/.claude/skills/digs
curl -o ~/.claude/skills/digs/SKILL.md https://raw.githubusercontent.com/haah-ing/digs-skill/main/SKILL.md

Other agents

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises activation through broad natural-language phrases like ordinary user conversation rather than a narrowly scoped command. In agent ecosystems, this can cause unintended invocation during unrelated chats, increasing the chance the skill reads or writes persistent research files when the user did not explicitly intend it.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill tells the agent to proactively route pasted links, articles, and observations into persistent dig files without waiting for explicit logging consent. This can silently retain personal, proprietary, or sensitive material the user only intended to discuss transiently.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Earlier guidance says to close properly by adding closure metadata and moving the file when the loop is figured out, implying direct action. Later, the closing section explicitly says to draft the resolution and confirm with the user before moving the file, creating conflicting operational intent in the documentation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Automatically interpreting 'curiosity signals' and extracting open questions from conversation encourages silent collection of user intent and beliefs into stored records. That makes the skill more dangerous in contexts where conversations may contain sensitive planning, health, financial, or interpersonal information.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill is presented as a local research-log organizer, and later explicitly says not to suggest automated research via web scraping. Yet it directs the agent to search for conceptual images online and to fetch updated skill content from GitHub, introducing network-fetch behaviors that are outside the stated local markdown-tracking role.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction to log conversational content automatically into existing files creates an ongoing data accumulation channel. Over time this can build a detailed dossier of user interests, relationships, and observations without clear retention limits or consent, increasing privacy and disclosure risk.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This sequence escalates from harmless note organization to autonomous status changes, heartbeat integration, and cron-based monitoring. That progression can condition trust while granting the skill persistence and recurring execution beyond what users expect from a research logging tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill authorizes file creation and possibly scheduled automation while telling the agent to 'mention what you did — don't ask first.' That removes an important consent checkpoint for system changes and can result in unauthorized persistence or host-level configuration changes.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 84% confidence

Finding

The skill advertises a direct remote update source on GitHub, effectively exposing a supply-chain path for future behavior changes. If paired with agent behaviors that fetch or trust that URL, an attacker who compromises the repository or upstream distribution can alter the skill without local review.

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

To update this skill to the latest version, fetch the new SKILL.md from GitHub and replace this file:

text

https://raw.githubusercontent.com/haah-ing/digs-skill/main/SKILL.md

---

Static analysis

No suspicious patterns detected.