Agency

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:14 PM UTC
• Version: 1.0.1

Overview

This is a non-executable agency-operations skill that stores business records locally, so it is coherent but users should protect the client and team data it creates.

Install only if you want Codex to help maintain a local agency workspace. Keep ~/agency out of shared or synced folders unless approved, restrict file permissions where possible, do not store passwords or API keys there, and minimize client, financial, and personnel details to what you actually need.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

Plaintext Persistence of Sensitive Agency, Client, and Personnel Data

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:29-39
• onboarding.md:47-64
• team.md:3-20
• feedback.md:13-23
• feedback.md:27-44

Vulnerability Type: Sensitive information stored in unprotected plaintext files
Risk Level: Medium

Vulnerable Content

SKILL.md:29-39:

markdown

Agency data lives in ~/agency/:

~/agency/ ├── clients/ # One file per client │ ├── index.md # Client list with status │ └── [name].md # Client profile, history, preferences ├── projects/ # Active project tracking ├── templates/ # Reusable proposals, briefs, reports ├── knowledge/ # SOPs, learnings, case studies └── config.md # Rates, margins, team structure

text

onboarding.md:47-64:

markdown

## Client Folder Setup

Create `~/agency/clients/[client-slug].md`:

```markdown
# [Client Name]

## Status: [prospect|active|past]
## Start date: [date]
## Primary contact: [name, email]

### Brand/Voice Notes
<!-- Tone, terminology, preferences -->

### Projects
<!-- List with dates and outcomes -->

### History Log
<!-- Key interactions, decisions, issues -->

text

`team.md:3-20`:

```markdown
## Team Database

Maintain in ~/agency/config.md:

```markdown
### Team Members

#### [Name]
- Role: [role]
- Skills: [skill1, skill2]
- Availability: [hours/week]
- Rate: [internal cost/hour]
- Current projects: [list]
- Notes: [preferences, timezone, communication style]

### Freelancers

#### [Name]
- Specialty: [what they're best at]
- Rate: [hourly/project]

text

`feedback.md:13-23`:

```markdown
`~/agency/knowledge/`:

knowledge/ ├── sops/ # Standard Operating Procedures │ ├── onboarding.md │ ├── proposal.md │ └── delivery.md ├── cases/ # Completed project summaries │ └── [project-name].md ├── learnings.md
...[truncated 3422 chars]

Remediation

View remediation

Remediation Suggestions

1. Create the workspace with restrictive permissions:

   • Set ~/agency/ and its subdirectories to mode 0700.
   • Set files containing client, financial, or personnel records to mode 0600.
   • Verify permissions after creating or modifying files.

2. Add explicit instructions prohibiting storage of passwords, API keys, access tokens, private keys, session cookies, and other authentication material in Markdown records. Use an operating-system keychain or dedicated secret manager instead.

3. Encrypt sensitive records or require full-disk or home-directory encryption. Document that the workspace should not be placed in an unapproved cloud-synchronized directory.

4. Minimize collected information:

   • Store only contact and operational details required for active work.
   • Avoid unnecessary personal observations in personnel notes.
   • Redact or pseudonymize completed-project records where possible.

5. Establish retention and deletion controls:

   • Define retention periods for prospect, past-client, project, and personnel records.
   • Archive only information with a documented business requirement.
   • Securely delete expired sensitive records and associated backups where feasible.

6. Separate data by sensitivity. Store financial data, personnel assessments, and client contact records in distinct protected locations rather than a single broadly accessible workspace.

7. Require user confirmation before persisting unusually sensitive client information and provide a warning when the target path appears to be shared, synchronized, or insufficiently protected.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill's activation text is broad enough to match a wide range of generic business or productivity requests, which can cause the agent to invoke this skill in contexts where the user did not intend agency-management behavior. That increases the chance of inappropriate file creation, business-process assumptions, or persistence of sensitive client-style data in unrelated workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to record client feedback and project details, which can easily include sensitive personal, commercial, or confidential information, but it provides no data handling, minimization, retention, or access-control guidance. In an agency context, these records are likely to accumulate across clients, increasing the chance of privacy breaches, unauthorized disclosure, or noncompliance with contractual and legal obligations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to create a local client file containing personal contact information and historical interaction notes, but it provides no warning, consent step, retention policy, or storage protection guidance. In an agency context this can lead to unnecessary collection and insecure persistence of client PII on disk, increasing exposure if the workstation, sync folder, or local environment is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs the user to maintain a team database containing personal and operational details such as names, availability, rates, notes, timezones, and work history, but gives no guidance on consent, minimization, access control, or retention. This can lead to unnecessary collection and insecure storage of employee or freelancer data in a local plaintext file, increasing privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.