Garden

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:13 PM UTC
• Version: 1.1.6

Overview

This garden-tracking skill stores garden notes locally and has some broad auto-logging language, but its behavior is disclosed, limited, and aligned with its purpose.

Install only if you want a local ~/garden/ folder used as ongoing garden memory. During setup, choose direct-invocation mode if you do not want casual plant mentions treated as trackable garden activity.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The statement that user engagement 'implies interest' encourages the agent to begin setup and assistance based on inferred intent rather than explicit consent. Because setup involves reading additional files and potentially creating persistent local state, this can lead to unauthorized or surprising actions.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill's activation scope is broad enough that it could engage during general gardening discussion without a clear user request to use structured memory or modify local files. In a file-writing skill, ambiguous activation increases the chance of unintended setup steps, file reads, or stateful tracking the user did not explicitly ask for.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Infer or save preferences without user confirmation
- Access weather APIs (climate is manually configured)
- Control hardware or irrigation systems
- Write outside `~/garden/` without asking first
- Make any network requests

## Related Skills

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The setup text instructs the agent to assume that mere engagement with the skill implies consent to receive help, which encourages overly broad activation behavior. Even though later text says to wait for explicit consent before saving anything, this still risks unsolicited intervention and ambiguous triggering based on normal plant-related conversation rather than a clear user request.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrase 'When user mentions garden activity, log it' is broad enough to activate on casual conversation or ambiguous references, which can cause unintended writes to the user's files. In a memory-tracking skill, silent activation increases the chance of incorrect or undesired state changes, especially when date, plant, or zone inference is done automatically.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions direct the agent to append to the current monthly log and update harvest data automatically, but they do not require notifying the user or obtaining confirmation before modifying files. Automatic persistent updates can create unauthorized or inaccurate records, particularly when the user's statement is ambiguous or conversational rather than an explicit request to save data.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: Line L13 directs the agent to 'Log the diagnosis' in a plant's health history, which implies modifying a file or record. The markdown does not warn the user that their plant records will be updated or suggest confirming before persisting the diagnosis.

Static analysis

No suspicious patterns detected.