Security audit

AI Boss Assistant

Security checks for vulnerabilities and agentic risk

Overview

This executive-assistant skill is mostly documented as a productivity template, but it includes high-impact setup and autonomy guidance that users should review before installing.

Install only after reviewing the setup commands, package identities, gateway service behavior, OAuth scopes, Telegram token handling, and Git backup steps. Use minimal Google scopes, avoid pipe-to-shell and unpinned global installs where possible, create .gitignore before any Git commit, require explicit confirmation before pushes or public/external actions, and disable camera/gateway/admin capabilities unless you intentionally need them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: setup/完整安裝指南-從零開始部署AI老闆助理.md:35
Finding: Unverified Remote Scripts Are Downloaded and Executed Directly
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: setup/README-AI老闆助理安裝與設定.md:20
Finding: Persistent Gateway Service Is Installed Without Adequate Hardening Guidance
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:89
Finding: Ambiguous and Unpinned Third-Party Package Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: setup/完整安裝指南-從零開始部署AI老闆助理.md:377
Finding: Sensitive Workspace Files Are Committed Before Ignore Rules Are Created
Content: View full analysis
.gitignore << EOF *.json *.log .env credentials/ tokens/ memory/*.md EOF ``` ### Technical Analysis The guide initializes Git, stages every file with `git add .`, and creates the initial commit before creating `.gitignore`. The workspace is expected to contain API configuration, OAuth material, memory, activity logs, and possibly service tokens. If any matching sensitive files exist when `git add .` is run, they are included in the initial commit. Creating `.gitignore` afterward does not untrack files already committed and does not remove data from Git history. A later push, repository backup, or archive operation can therefore disclose the committed information. ### Attack Path 1. The user configures the assistant, OAuth integrations, logs, memory, or environment variables. 2. Sensitive files are present in the assistant workspace. 3. The user follows the guide and runs `git add .`. 4. Git stages all files, including sensitive files not yet covered by ignore rules. 5. The initial commit permanently records those files in repository history. 6. The repository is later pushed, shared, backed up, or inspected by another user. 7. Credentials or private assistant data are recovered from the commit. ### Impact Assessment Potentially exposed information includes: - API keys and environment variables - OAuth client JSON files - Authentication tokens - Private memory and daily activity records - Logs containing file names, account information, or operational details - Browser authentication state if stored in the workspace A disclosed token may permit direct access to the associated external service until it is revoked. Even if a sensitive file is deleted from the work ...[truncated 62 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: agent-persona/RULES.md:280
Finding: Behavioral Rules Permit Unconfirmed Repository Pushes and Persistent State Modification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: setup/完整安裝指南-從零開始部署AI老闆助理.md:475
Finding: Troubleshooting Instructions May Expose the Telegram Bot Token
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (78)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The phrase 'Do first, report later' explicitly encourages autonomous execution before user confirmation, which is especially risky for a skill integrated with Gmail, Calendar, Drive, and automation tooling. In this context, the agent could send emails, modify schedules, alter documents, or trigger workflows without meaningful human review, increasing the chance of irreversible or externally visible actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The camsnap capability enables camera footage capture, which is unrelated to the declared executive-assistant functionality and introduces serious privacy and surveillance risk. If abused, it could silently collect sensitive visual information from monitored environments and exfiltrate it through other available messaging or file tools.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented exec capability allows arbitrary local shell command execution, which is far beyond what an executive-assistant skill should require. If triggered by ambiguous natural-language requests or prompt injection from emails/files/web content, it could lead to command execution, local data theft, credential access, or system compromise.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented gateway capability permits viewing/updating gateway configuration and restarting services, giving the assistant control over core platform behavior. In the context of an executive-assistant skill, this is unjustified and dangerous because misuse could disable safeguards, alter routing, introduce persistence, or cause denial of service.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gog/gog Setup and Usage（英文版）.md (reported line 63)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gog/gog Setup and Usage（英文版）.md (reported line 71)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gog/gog Setup and Usage（英文版）.md (reported line 77)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gog/gog Setup and Usage（英文版）.md (reported line 316)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gog/gog Setup and Usage（英文版）.md (reported line 322)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gog/gog Setup and Usage（英文版）.md (reported line 327)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gog/gog 安裝與使用教學.md (reported line 58)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gog/gog 安裝與使用教學.md (reported line 66)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gog/gog 安裝與使用教學.md (reported line 72)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gog/gog 安裝與使用教學.md (reported line 305)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gog/gog 安裝與使用教學.md (reported line 310)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · gog/gog 安裝與使用教學.md (reported line 314)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · security/AI老闆助理資安防護說明.md (reported line 44)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · security/AI老闆助理資安防護說明.md (reported line 53)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup/README-AI老闆助理安裝與設定.md (reported line 82)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup/README-AI老闆助理安裝與設定.md (reported line 87)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup/完整安裝指南-從零開始部署AI老闆助理.md (reported line 173)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup/完整安裝指南-從零開始部署AI老闆助理.md (reported line 176)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup/完整安裝指南-從零開始部署AI老闆助理.md (reported line 179)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup/完整安裝指南-從零開始部署AI老闆助理.md (reported line 448)May include surrounding context.
md
3. **本機環境保護** - 開啟 FileVault 磁碟加密。 - 一定要有登入密碼與螢幕鎖。 - 不要把 `credentials.json` 與 token 檔同步到公開雲端硬碟（如無加密的 Dropbox、公開 GitHub）。 ---

Chaining Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: curl ... | sudo -E bash - is a dangerous chained execution pattern because it fetches remote content and immediately executes it as root. In a setup guide for broad end-user deployment, this is especially risky because users are likely to copy-paste it without inspection, amplifying supply-chain or interception impact.
Content: Scanner excerpt · setup/完整安裝指南-從零開始部署AI老闆助理.md (reported line 53)May include surrounding context.
Linux (Ubuntu/Debian)

bash
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - sudo apt-get install -y nodejs # 驗證

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T06 · System Persistence

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

SkillSpector

Missing User Warnings

Context-Inappropriate Capability

Context-Inappropriate Capability

Context-Inappropriate Capability

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Chaining Abuse

Linux (Ubuntu/Debian)

Static analysis