T06 · System Persistence
Error
- Location
SKILL.md:102- Finding
Persistent Unattended Agent Execution Through a Nightly Scheduled Task
- Content
View full analysis
- Remediation
View remediation
Security audit
Nightly Build
Security checks for vulnerabilities and agentic risk
Overview
The skill is transparent about overnight automation, but it grants broad recurring access to conversations, memory, files, scripts, and messaging without enough scoping or review controls.
Install only if you are comfortable with an agent running every night without you present. Before enabling it, narrow the session and memory sources it may read, keep outputs local by default, require review before any external message, prohibit unattended script or alias creation, and add an explicit way to pause or remove the cron job.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:106- Finding
Broad Recurring Access to Private Session History and Persistent Memory
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:51- Finding
Unapproved Creation of Executable Scripts and Modification of Persistent Workspace State
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This is a direct policy contradiction: the skill says external-facing actions are never allowed without permission, then instructs the agent to send a briefing via a configured messaging channel. In practice, agents often treat the operational step as authoritative, so this inconsistency can lead to unauthorized outbound messages containing sensitive context from scanned sessions or memory files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill is explicitly designed to make autonomous workspace changes while the user sleeps, but the top-level description does not clearly warn that it may modify files, scripts, memory, or repository state. That omission increases the risk of users enabling the skill without understanding the breadth of autonomous changes, which can lead to unintended file edits, repo churn, or disruption of established workflows.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill states that external-facing actions are Tier 3 and require permission, yet its nightly workflow still includes sending a morning briefing through a messaging channel as part of routine execution. That creates an autonomous outbound communication path that may disclose session-derived or workspace-derived information without an explicit per-run approval, undermining the stated safety boundary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The morning briefing is generated from session history and memory files, but the skill provides no privacy notice or data-minimization guidance before sending that content through a messaging channel. This creates a realistic risk of leaking sensitive conversation details, internal project information, or personal data into third-party messaging systems.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The example configuration fixes the timezone to 'America/Chicago', which imposes a locale-specific default without user opt-in. The policy allows locale constraints only when justified or optional, and neither is provided here.
- Content