Security audit

Aps Filesystem Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent APS knowledge-base purpose, but its documented write and commit flows are too broad and could persist or modify sensitive local business data unexpectedly.

Install only if you are comfortable with an APS agent maintaining a local, Git-backed memory of customer rules and scheduling decisions. Before using it with real customer data, tighten path validation, restrict Git staging to approved files, avoid storing raw conversation quotes or secrets, define retention/deletion rules, and use a pinned dependency environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:229
Finding: Unrestricted Proposal Path Allows Arbitrary JSON File Processing and Deletion
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:150
Finding: Unvalidated Identifiers Permit Path Traversal and Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation
str: if not IDENTIFIER.fullmatch(value): raise ValueError("Invalid identifier") return value ``` - Reject absolute paths, separators, drive prefixes, null characters, and `.` or `..` path components. - Resolve each completed destination and verify it remains below the expected directory with `Path.is_relative_to()` or an equivalent containment check. - Refuse to follow symlinks in writable directories. - Use exclusive creation where overwriting is not expected. - Separate display identifiers from filesystem-generated names; a random UUID can be used as the actual filename. - Apply the same validation consistently to rule IDs, session IDs, problem types, categories, and all future path-derived fields. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:103
Finding: Untrusted Vector-Index Metadata Can Cause Reads Outside the Knowledge Base
Content: View full analysis
list[dict]: collection = client.get_collection("domain_rules") results = collection.query( query_texts=[query], n_results=top_k, where={"status": "active"} ) rules = [] for rule_id, meta in zip(results["ids"][0], results["metadatas"][0]): path = kb / meta["file_path"] rules.append(json.loads(path.read_text())) return rules ``` ### Technical Analysis The function treats ChromaDB metadata as trusted and reads `meta["file_path"]` without validation. If the metadata contains an absolute path, Python path joining can discard the `kb` prefix. If it contains traversal components, the resulting path can escape the knowledge-base root. Index metadata may become attacker-controlled through index poisoning, unsafe imports, filesystem tampering, or another vulnerable write path. The function also does not verify that the loaded rule ID matches the result ID or that the resolved file belongs to `domain_rules`. ### Attack Path 1. An attacker inserts or modifies a ChromaDB record whose `file_path` points outside `aps_knowledge_base/domain_rules`. 2. The malicious record is marked `active` and made relevant to a likely semantic query. 3. `get_relevant_rules()` retrieves the record. 4. The function joins and reads the attacker-controlled path without a containment check. 5. The external JSON content enters the Agent's scheduling context and may influence subsequent decisions. ### Impact Assessment The Agent can be induced to read arbitrary JSON files accessible to its process. Data from those files may be exposed in model context or later output. If the selected JSON resembles an APS rule, it can also influence scheduling behavior. The direct scope is read acc ...[truncated 46 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:329
Finding: Broad Git Staging Can Commit Unrelated or Sensitive Repository Files
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: references/scripts.md:24
Finding: Unpinned ChromaDB Installation Instruction Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
--hash=sha256: ``` ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.
for rule_id, meta in zip(results["ids"][0], results["metadatas"][0]): path = kb / meta["file_path"] rules.append(json.loads(path.read_text())) return rules

text
### Load a problem schema template

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description says to use the skill for many broad situations, including when the agent 'needs to understand what knowledge is available before making scheduling decisions' or 'wants to persist something learned in a conversation.' Those conditions are not narrowly bounded to specific trigger phrases or exclusion cases, which could cause the skill to be invoked for common scheduling tasks whenever knowledge might be relevant.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill encourages persisting conversation-derived customer information into a long-term filesystem knowledge base by default. That creates a data retention risk because sensitive operational details, personal data, or confidential client instructions may be stored indefinitely in plain files, indexed for retrieval, and committed to Git, expanding exposure and making deletion difficult.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: L140-L141 states that the agent 'NEVER writes directly to the main knowledge directories' and that all new knowledge goes to pending_review first. However, the confirmation flow for client memory updates in L268-L278 modifies client_memory/_profile.json directly in the live knowledge base, which contradicts that absolute claim about write behavior.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The proposal flow stores raw source quotes and session identifiers in persistent JSON files. If users share credentials, personal data, commercial terms, or sensitive shop-floor information in conversation, this design preserves that material verbatim and links it to a session, increasing disclosure risk through later reads, backups, indexing, or Git history.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the agent to present the proposal confirmation prompt using fixed Chinese text, but it does not offer the user a language or locale choice. This creates a language policy issue because the skill forces a specific language regardless of user preference or prior opt-in.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Persistent logging of scheduling decisions and session history can accumulate sensitive operational intelligence, user-provided content, and rule-usage patterns over time. In a local filesystem plus Git-backed design, those records may be broadly readable to local users, retained longer than intended, and difficult to purge once committed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file documents a script that deletes the existing domain_rules collection and rebuilds it from scratch, which can remove the current index state. Although the embedded code has a brief comment about a clean rebuild, the user-facing markdown description does not clearly warn that running the script performs a destructive reset.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This section documents a helper that increments use_count, updates last_used_at, writes the rule JSON file back to disk, and may update ChromaDB metadata. The markdown description says it is called after each scheduling session, but it does not clearly warn users that persistent rule records are automatically modified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The heading at L357 describes deprecation as a soft disable that should prevent normal use, and the comment at L369 says the rule is removed from the vector index so it won't be retrieved. But the code at L372 updates the indexed metadata to status: deprecated rather than deleting the entry, so the implementation does not match the comment's stated action.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file includes a natural-language schema example that sets "language": "zh-CN" as the client preference. Because the file does not indicate that language is selectable, optional, or region-specific, it can be read as enforcing a specific locale without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The markdown instructs users to paste an inline helper that writes _index.json, but the surrounding description does not explicitly disclose that it modifies on-disk index metadata. For markdown-scoped warning checks, user-facing documentation should mention file modification when behavior affects stored data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.