Maya Loop

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed engineering workflow, but it asks agents to auto-run broad operational, backup, memory, and scheduled service-control behavior without enough user scoping or confirmation.

Review before installing. Only use this in a tightly controlled engineering environment after replacing hard-coded approvers, removing automatic activation, disabling global memory writes and skill creation, defining backup destinations and secret filtering, and requiring explicit approval before service control, deployment, cloud transfer, or scheduled automation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:28

Finding

Mandatory Cross-Task Agent Behavior Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-39
Vulnerability Type: Mandatory automatic workflow activation without user confirmation
Risk Level: High

Complete Evidence Snippet:

text

> **不需要 Jason 说触发词。只要进入研发场景——无论什么产品——麦麦自动启动 Maya Loop。**

麦麦在以下任何时刻**必须**自动对照 Maya Loop 走六步，不等待、不询问、不跳过：

| 触发信号 | 麦麦自动行为 |
|:---|:---|
| `Write` / `Edit` 工具被调用修改代码或配置 | 自动启动 Loop，跑完「定→拆→做→验→备→记」 |
| `Bash` 执行 `docker compose` / `git push` / `systemctl restart` / `scp` 等部署命令 | 自动启动 Loop |
| 对话中出现"部署""上线""发布""改一下""修一下""加个功能" | 自动启动 Loop |
| 任何涉及文件修改 + 需要回滚能力的操作 | 自动启动 Loop |

**这不叫"等 Jason 说"——这叫"麦麦的肌肉记忆"**。就像呼吸一样，不经过大脑决策。这是 Maya Loop 存在的唯一意义。

Technical Analysis

The Skill directs the Agent to activate its workflow in every product-development context and explicitly says not to wait, ask questions, or skip steps. Activation can be triggered by generic phrases or ordinary editing and deployment tool calls rather than explicit invocation of the Skill.

This changes the Agent's decision-making and authorization boundaries when the Skill is loaded. The mandatory workflow includes backup, persistent recording, deployment verification, and other actions that may exceed the scope of the user's immediate request.

Attack Path

1. The Skill is loaded into an Agent session.
2. A user makes an ordinary engineering request or invokes an editing or deployment tool.
3. The broad trigger conditions activate the six-step workflow automatically.
4. The Agent follows the instruction not to wait for or request further confirmation.
5. Backup, record-keeping, deployment, or other workflow stages may be performed even when the user requested only a narrowly scoped change.

Impact Assessment

The instruction can redirect unrelated engineering tasks and cause unauthorized file writes, backup operations, or deployment-related actions. The exact privileges available depend on the Agent's tool permissions, ...[truncated 147 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user invocation before activating the workflow.
• Remove universal triggers based on generic phrases, editing tools, or deployment tools.
• Remove instructions stating that the Agent must not wait, ask, or skip steps.
• Require separate confirmation before backups, deployments, remote copies, service changes, and persistent-state writes.
• Scope the workflow to the current project and task rather than every product-development context.
• Present a concrete action plan and affected resources before executing any operation.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:124

Finding

Persistent Cross-Project Agent Memory Modification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 124-130
Vulnerability Type: Persistent modification of project and global Agent memory
Risk Level: High

Complete Evidence Snippet:

text

### 第六步：记（Record）

- [ ] 更新项目 MEMORY.md（版本号、教训）
- [ ] 追加当日日志 YYYY-MM-DD.md
- [ ] 如有跨项目通用的教训 → 写全局 ~/.workbuddy/MEMORY.md
- [ ] 如有可复用的工作流 → 固化为 skill
- [ ] **[v5.0 新增] 记录本轮有无违反 Karpathy 12 条的行为及处理方式**

Technical Analysis

The mandatory recording stage directs the Agent to write information to project memory, a global cross-project memory file, and potentially a newly created Skill. These destinations can persist after the current task and influence later conversations or unrelated projects.

Because the content is generated under the control of the loaded Skill, global memory writes can propagate the Skill's behavioral rules beyond its original invocation. Converting the workflow into another Skill creates an additional persistence and replication mechanism.

Attack Path

1. A normal engineering action triggers the mandatory workflow.
2. The Agent reaches the recording stage.
3. Skill-derived lessons or workflow rules are written to MEMORY.md or ~/.workbuddy/MEMORY.md.
4. The Agent may also package the workflow as another Skill.
5. Future sessions or projects consume the persistent state and continue applying the inserted behavior without reloading the original Skill.

Impact Assessment

Successful exploitation can produce cross-session and cross-project behavioral influence. It can contaminate global Agent state, affect later task planning, and replicate the workflow into additional Skills. The filesystem privileges required are those needed to write the project directory or the user's home-directory memory store.

Remediation

View remediation

Remediation Suggestions

• Remove all automatic writes to global memory and all automatic Skill-generation instructions.
• Restrict record-keeping to a clearly identified project-local file.
• Require explicit user approval before creating or updating any persistent memory.
• Show the exact destination and proposed content before writing.
• Prevent project Skills from modifying global Agent policy, memory, or other Skills.
• Treat memory files as sensitive policy stores and enforce allowlisted writers and auditable changes.

T06 · System Persistence

Error

• Location: SKILL.md:176

Finding

Recurring Autonomous Jobs with Automatic Service Control

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 176-232
Vulnerability Type: Cross-session scheduled operation and automatic service management
Risk Level: High

Complete Evidence Snippets:

text

| 環 | 做什麼 | 心跳 |
|----|--------|------|
| **Guardian 守護環** | 伺服器巡檢、Docker 管理、站點監測，L0-L3 自治梯度 | 每小時 |
| **Digester 消化環** | 知識庫自動精讀、雙向關聯（正向+反向）、認知更新標記 | 每日 |
| **Sentinel 哨兵環** | 合規矩陣、法規掃描、SSL 證書到期 | 每週 |
| **Shepherd 牧人環** | 會話恢復、心跳監控、信號回執掃描、Dev Loop 監聽、審查追蹤 | 4h |
| **Review 審查環** | 三角審查模式：設計產出 → 外部挑戰 → 收斂 → 決策 | 事件驅動 |

text

| 級別 | 操作 | 權限 |
|------|------|------|
| L0 自癒 | Docker restart / nginx reload | 自動·事後通知 |
| L1 告警 | 磁碟 85% / CPU 持續高 / 監測中斷 | 即時通知 |
| L2 需確認 | 伺服器 reboot / 回滾部署 / 防火牆 | Jason 確認後執行 |
| L3 僅報告 | 安全入侵跡象 / 數據異常 | 僅分析不操作 |

text

1. 創建 `.workbuddy/audit/` 目錄
2. 拷貝 `scripts/` 下五個引擎到該目錄
3. 修改 `devloop.py` 中的 `PROJECT_PATHS`（專案路徑和伺服器位址）
4. 修改 `signal.py` 中的 `SIGNAL_ROUTES`（環間信號路由規則）
5. 設置信號回執的審查者角色（`review.py` 中的 `REVIEW_ROLES`）
6. 設置自動化：Guardian 每小時 + Shepherd 每 4h

Technical Analysis

The Skill describes installation of recurring Guardian and Shepherd automation that continues operating after the initial Skill run. Guardian is authorized to restart Docker and reload nginx automatically, with notification only after the action.

This constitutes persistence through scheduled tasks or equivalent automation. It also removes contemporaneous authorization from service-control actions. Although the referenced implementation scripts are absent from the audited package, the deployment instructions explicitly direct the Agent to establish this persistent behavior.

Attack Path

1. An operator or Agent follows the deployment instructions.
2. Engine files are copied into .workbuddy/audit/ and configured with project paths and server addresses.
3. Guardian is scheduled hourly and Shepherd every four hours.
4. The recurring jobs survive ...[truncated 820 chars]

Remediation

View remediation

Remediation Suggestions

• Remove scheduled automation from the default Skill workflow.
• Require explicit, separately scoped approval before installing any scheduled task or persistent service.
• Default all monitoring components to read-only reporting.
• Require pre-action confirmation for every Docker restart, nginx reload, reboot, rollback, and firewall operation.
• Run monitoring under a dedicated least-privilege account without unrestricted Docker or administrative access.
• Document scheduler type, installation path, owner, logs, retention, and a complete uninstall procedure.
• Include and audit all referenced implementation scripts before deployment.
• Add rate limits, maintenance-window controls, health verification, rollback procedures, and safeguards against restart loops.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:116

Finding

Unspecified Cloud Backup of Databases and Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 116-122
Vulnerability Type: Unsafe handling and transfer of potentially sensitive backup data
Risk Level: Medium

Complete Evidence Snippet:

text

### 第五步：备（Backup）

**必须三项，不变。**

- [ ] **版本号更新**（3 位数字：v{major}.{minor}.{patch}）
- [ ] **云端备份**：变更文件 + 数据库 + 配置 + VERSION.txt
- [ ] **本地备份**：同上
- [ ] MD5 校验一致性

**VERSION.txt 必须包含**：版本号、日期、变更摘要、涉及文件列表、回滚命令。

Technical Analysis

The Skill mandates cloud and local backups of changed files, databases, and configuration. It does not define an approved destination, transport security, encryption, access control, secret filtering, data minimization, retention, or user confirmation.

Databases and configuration files commonly contain credentials, tokens, personal data, internal endpoints, or other sensitive material. MD5 consistency checking does not provide confidentiality and is not a suitable modern integrity control against malicious modification. No concrete upload endpoint or implementation was present, so actual exfiltration is not established; the risk arises from the mandatory unsafe backup instruction.

Attack Path

1. An editing or deployment action automatically triggers the workflow.
2. The Agent reaches the mandatory backup stage.
3. Changed files, configuration, and database content are collected.
4. The collected data is copied locally and transferred to an unspecified cloud destination.
5. Secrets or regulated information may be exposed to an unauthorized destination or retained without appropriate controls.

Impact Assessment

The operation could disclose all data available to the Agent in the selected database and configuration files, including credentials or personal information. Exposure scope depends on the files selected, database access available to the Agent, and the actual cloud destination. Local backups may also create additional plaintext copies accessible to ...[truncated 32 chars]

Remediation

View remediation

Remediation Suggestions

• Make all backup operations opt-in and require explicit confirmation immediately before transfer.
• Enumerate the exact files, database objects, destination, and retention period in advance.
• Use only organization-approved backup destinations with authenticated encrypted transport and encryption at rest.
• Exclude secrets, tokens, private keys, environment files, and unnecessary personal data by default.
• Apply least-privilege credentials and destination-side access controls.
• Replace MD5 with an authenticated integrity mechanism or a modern cryptographic hash where appropriate.
• Define secure local permissions, lifecycle controls, retention limits, deletion procedures, and audit logging.
• Provide a dry-run manifest so the user can inspect all data before collection or upload.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill declares extremely broad auto-trigger conditions, including ordinary development activities and any Write/Edit or Bash usage, causing the workflow to activate without clear, user-scoped consent. In an agent setting, broad implicit activation can steer behavior during many unrelated tasks and increase the chance of unintended file modification, deployment actions, or policy override by the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger table uses vague conversational phrases such as 'deploy', 'fix', or 'add a feature' as mandatory activation signals, without precise boundaries or disambiguation. This makes normal conversation act as an instruction channel, which is dangerous because it can unexpectedly bind the agent to a procedural framework that authorizes edits or operational steps beyond what the user explicitly requested.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

- [ ] 拆成独立可执行的小步骤
- [ ] **[K3] 保持简单** — 每个子任务检查：能用现有工具吗？能用标准库吗？能用开源组件吗？禁止过早抽象、臆想式错误处理、无意义可配置、单实现接口
- [ ] **[K4-prep] 外科手术式** — 确认每一步触及的文件都在白名单内（.env / docker-compose.yml / config/*.yaml / prompts/*.md / collectors/*.yaml），不在白名单的标为红牌禁止触碰
- [ ] 每步有明确的验收标准
- [ ] 标出依赖关系（哪步必须先做）
- [ ] 预估每步的风险等级

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

- [ ] 拆成独立可执行的小步骤
- [ ] **[K3] 保持简单** — 每个子任务检查：能用现有工具吗？能用标准库吗？能用开源组件吗？禁止过早抽象、臆想式错误处理、无意义可配置、单实现接口
- [ ] **[K4-prep] 外科手术式** — 确认每一步触及的文件都在白名单内（.env / docker-compose.yml / config/*.yaml / prompts/*.md / collectors/*.yaml），不在白名单的标为红牌禁止触碰
- [ ] 每步有明确的验收标准
- [ ] 标出依赖关系（哪步必须先做）
- [ ] 预估每步的风险等级

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly associates automatic triggering with code/config modification and Bash deployment actions, but does not present a prominent safety warning, approval gate, or least-privilege boundary at the point of activation. In practice, this normalizes system-impacting behavior and increases the risk that an agent performs consequential operations without adequately informed user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The skill hard-codes a reviewer/approver identity ('Jason') as part of its activation and approval model, reducing user choice and creating an authorization assumption that may not match the actual operator. While less severe than direct command execution issues, fixed persona or approver constraints can misroute approvals and undermine proper access-control expectations in multi-user or reusable deployments.

Content

No source excerpt is available for this finding.