Security audit

Workspace Bootstrap

Security checks for vulnerabilities and agentic risk

Overview

This workspace setup skill is not malicious, but it encourages persistent personal data, possible credential storage, and whole-workspace sharing without enough safeguards.

Install only if you are comfortable managing a persistent agent workspace. Create it in a new empty directory, review any existing files before running bootstrap or wizard, do not store raw API keys or SSH secrets in markdown files, and add a .gitignore before using Git. Treat USER.md, SOUL.md, memory, reports, shared, and user-data as private unless you have reviewed and redacted them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill explicitly promotes one-command creation of workspace structure and core files, but the documentation shown does not warn that it will modify the current workspace, create many directories, or potentially overwrite existing files. In an agent setting, this can lead to unintended filesystem changes, clobbered project state, or misuse in the wrong directory because users may invoke it without understanding the scope of changes.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The quickstart tells users to print `SOUL.md` and `USER.md` directly to the terminal without warning that these files may contain personal profile data, behavioral preferences, or other sensitive workspace configuration. While this is not inherently malicious, it increases the risk of accidental disclosure through shared terminals, terminal logging, screen sharing, or shell history capture.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The team-collaboration instructions initialize a Git repository and push the entire generated workspace to a remote without warning that files like `USER.md`, `SOUL.md`, memory artifacts, or `user-data` may contain sensitive personal or organizational information. This can cause unintended disclosure to remote hosts, other collaborators, or public repositories if users follow the guide verbatim.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The replication workflow instructs users to copy `SOUL.md`, `USER.md`, and the entire `user-data` directory between machines without any warning about confidentiality, integrity, or secure transfer considerations. Even though `scp` is encrypted in transit, blindly transferring these files can spread sensitive personal data to less secure systems or unintended destinations.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The guide explicitly instructs users to collect and persist personally identifying information such as name, timezone, notes, age, profession, and work history in USER.md, but provides no minimization, consent, retention, access-control, or handling guidance. In an agent workspace context, these files are likely to be broadly read by tools and agents, which increases the chance of over-collection and unintended exposure of sensitive user context.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The documentation recommends putting the entire workspace into a Git repository and sharing it with teammates, while the same guide defines the workspace as containing USER.md, memory logs, reports, and other potentially sensitive files. Without explicit warnings, ignore rules, or sanitization steps, this can directly lead to exfiltration of private user data, internal notes, and agent memory through commits or remote pushes.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The instruction 'Don't ask permission. Just do it.' encourages autonomous action before obtaining user confirmation or establishing safe context. In an agent workspace template, this can normalize acting on local files and memory sources without consent, increasing the chance of privacy violations or unintended side effects if adopted broadly by downstream agents.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The template explicitly includes automated cleanup of files in temp/ older than 7 days, but provides no safeguard such as user notice, confirmation, exclusions, or recovery guidance. In an agent skill, unattended deletion can cause accidental data loss if temp/ contains still-needed work artifacts, logs, or misclassified files.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The template explicitly suggests storing API keys and SSH-related configuration in TOOLS.md, but provides no safeguards such as encryption, access controls, redaction, or exclusion from version control. This normalizes unsafe secret handling and can lead to credential leakage through shared workspaces, logs, backups, or repository commits.

Ssd 3

Medium

Confidence: 89% confidence
Finding: The template directs collection and maintenance of user profile data, preferences, projects, and logs in persistent workspace memory structures without defining minimization, retention, or sensitivity boundaries. This encourages over-collection of personal data and makes privacy leakage more likely if the workspace is shared, synced, or inspected by multiple agents/tools.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The startup workflow instructs every new session to automatically read USER.md and recent logs, establishing broad default access to historical personal data regardless of task need. This weakens least-privilege boundaries and can expose unrelated or sensitive context to sessions, subagents, or operators that do not require it.

Ssd 3

Medium

Confidence: 87% confidence
Finding: The shared inbox/outbox/status/working workspace pattern enables data to move across agents, but the template provides no confidentiality model, access segregation, or restrictions on what may be placed in shared directories. In multi-agent environments, this can cause unnecessary propagation of personal or sensitive data and broaden exposure if one component is compromised or misconfigured.

Static analysis

No suspicious patterns detected.