Company Ops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:15 AM UTC
• Version: 2.0.1

Overview

This skill is a real autonomous operations loop, but it can persist broad agent rules and automatically publish repository changes with misleading setup guidance.

Install only after reviewing the script and running it in a sandbox or private test repository. Do not paste the constitution into global agent policy or SOUL.md unless you intentionally want those rules to persist across agents. Avoid the raw main-branch curl install, do not rely on '--help' as harmless, and disable automatic git add/commit/push until you add path allowlists, secret checks, and human review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: CONSTITUTION.md:12

Finding

Persistent Agent Identity and Policy Hijacking

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: CONSTITUTION.md:154

Finding

Unreviewed Agent-Generated Content Is Promoted into Persistent Memory

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:32

Finding

Installation Retrieves Mutable Remote Python Code and the Documented Help Command Executes It

Content

View full analysis

= 2 and sys.argv[1] == "self-test": sys.exit(_self_test()) log("=== autonomy tick start ===") ``` ### Technical Analysis The installation instructions retrieve executable Python from the mutable `main` branch of a repository controlled by a personal GitHub account. The download is not pinned to a commit and is not authenticated with a checksum or signature. The payload users execute can therefore differ from the version included in and reviewed with this Skill. The documented `--help` command is also misleading. The script has no argument parser and does not recognize `--help`. Any argument other than `self-test` falls through to the operational loop, which performs network synchronization, repository writes, commits, and pushes. HTTPS protects the transport connection but does not protect against repository compromise, account compromise, malicious upstream modification, or an unexpected force-push to the mutable branch. ### Attack Path 1. The upstream repository, maintainer account, or `main` branch is maliciously modified or compromised. 2. A user follows the documented `curl -O` installation command. 3. The current upstream payload is downloaded without version pinning or integrity verification. 4. The user runs `python autonomy-loop.py --help`, expecting a harmless help display. 5. Because `--help` is not i ...[truncated 609 chars]

Remediation

View remediation

other

Error

• Location: autonomy-loop.py:215

Finding

Repository-Wide Automatic Git Staging and Push Can Publish Sensitive Data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: autonomy-loop.py:110

Finding

Confidence Consultation Gate Logs a Warning but Continues Execution

Content

View full analysis

consult second model (deferred this tick)") if CONFIDENCE < ESCALATE_THRESHOLD: log(f"CONFIDENCE {CONFIDENCE}% < {ESCALATE_THRESHOLD}% -> ESCALATE to human (S0.6). No action taken.") return "escalated: confidence too low" # Default autonomous step when no specific task matches: ``` The thresholds and confidence value are fixed globals: ```python CONFIDENCE = 85 PROCEED_THRESHOLD = 75 ESCALATE_THRESHOLD = 50 ``` ### Technical Analysis For confidence values from 50 through 74, the first condition logs that a second-model consultation is required, but it does not return, raise an exception, or record a blocking state. The second condition is false in this range, so execution continues into `do_work()`, followed by automatic commit and push logic. The message says consultation is “deferred this tick,” but the action is not actually deferred. This is a fail-open control: failure to complete the required validation does not prevent the protected operation. Confidence is also a fixed global constant rather than an assessment derived from the selected task, its reversibility, destination, data sensitivity, or requested privileges. Therefore, the gate does not provide the task-specific risk assessment advertised by the documentation. ### Attack Path 1. `CONFIDENCE` is configured to a value between 50 and 74. 2. The loop selects an actionable task. 3. The code logs that a second model should be consulted. 4. No consultation occurs and no blocking return is executed. 5. `do_work()` modifies the repository. 6. The main loop stages, commits, and potentially pushes the resulting changes. 7. Operators may incorrectly interpret the log ...[truncated 543 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONSTITUTION.md (reported line 236)May include surrounding context.

md

## 13. Operating Cadence

- **Daily (heartbeat):** work the task board, close finished tickets, log outcomes, write/update skill files.
- **Weekly:** review each active project's metric vs. its Section 11 target; kill or promote; commit knowledge-base updates.
- **Monthly:** re-run the Section 4 validation pass on core stack; revisit Section 10 with real numbers, not projections.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README markets a '24/7' autonomous company loop that can track tasks, revenue, and self-improve, but it does not clearly warn users that autonomous operation may change business state or trigger consequential actions if the underlying script is run. Although the document mentions confidence-gating and escalation, those claims are not a substitute for explicit safety limitations, approval requirements, and scope boundaries, especially in an agent/automation context where users may overtrust promotional language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill explicitly promotes a 24/7 autonomous loop that manages tasks, revenue, and self-improvement, but it does not present concrete warnings, guardrails, approval requirements, or limits on what systems/data the automation may affect. Even though the text mentions 'confidence-gated' behavior and escalation of low-confidence actions, that is a safety claim rather than an enforceable safeguard in the skill description, so users may deploy continuous autonomous operations without understanding operational, financial, or data-handling risks.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · autonomy-loop.py (reported line 53)May include surrounding context.

python

def free_ram_mb():
    try:
        out = subprocess.check_output(
            ["wmic", "OS", "Get", "FreePhysicalMemory", "/Value"],
            stderr=subprocess.DEVNULL, text=True, timeout=20)
        for ln in out.splitlines():

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · autonomy-loop.py (reported line 65)May include surrounding context.

python

return 9999

def git(*args, cwd=REPO_LOCAL, timeout=60):
    return subprocess.run(["git"] + list(args), cwd=cwd, timeout=timeout,
                          capture_output=True, text=True)

def pull_source_of_truth():

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The function logs that 50-74% confidence actions should be deferred or consulted, but it only blocks execution below the lower threshold and still performs work for mid-confidence tasks. In an autonomous agent that writes files and later commits/pushes changes, this mismatch weakens a stated safety control and can lead to unintended actions being carried out under uncertainty.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script autonomously modifies local knowledge-base files as part of normal operation without any interactive approval, dry-run mode, or scoped authorization. In this skill's context, that is more dangerous because the loop is explicitly designed for recurring autonomous execution, so accidental or manipulated task selection can repeatedly alter repository contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script automatically commits and pushes any detected changes to GitHub with no confirmation or transmission-time warning. In an autonomous loop that first pulls remote content and selects tasks from repository-controlled files, this creates a clear path for unreviewed changes to be propagated externally, amplifying mistakes or malicious task-board manipulation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

This helper executes an arbitrary Python file from the target product directory (python <file> self-test) as part of verification. In a CI or analyst environment, an untrusted repository can place malicious code in any discovered .py file and gain code execution during the verification step, making this a real command-execution risk even though shell=True is not used.

Content

Scanner excerpt · ci/verify_product.py (reported line 37)May include surrounding context.

python

def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 67)May include surrounding context.

python

all_ok &= axis(False, "frontmatter (no SKILL.md)")
        all_ok &= axis(False, "docs (no SKILL.md)")
    # 3 compiles
    comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp],
                                capture_output=True).returncode == 0 for fp in files)
    all_ok &= axis(comp_ok, "compiles (py_compile all .py)")
    # 4 self-test (any of 3 valid forms)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

This code executes any test_*.py or *_test.py file found in the target folder. Since the repository under verification is untrusted, an attacker can include a malicious test file that runs arbitrary code during CI verification, potentially exfiltrating secrets or modifying the runner environment.

Content

Scanner excerpt · ci/verify_product.py (reported line 79)May include surrounding context.

python

tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 92)May include surrounding context.

python

# 7 deploy-ready
    ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py")
    if os.path.isfile(ci) and os.path.isfile(skill):
        r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True)
        all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)")
    else:
        all_ok &= axis(True, "deploy-ready (skipped)")