Security audit

workspace-health-dashboard

Security checks for vulnerabilities and agentic risk

Overview

This health dashboard is read-only, but it overstates security checks and can report the workspace healthy when important warnings exist.

Treat this as a lightweight read-only inventory dashboard, not a reliable security gate. Before relying on it for workspace approval or deployment decisions, the dependency check should be relabeled or backed by a real vulnerability audit, and protected-skill warnings should affect the overall health result.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: index.js:145
Finding: Dependency Security Check Reports Success Without Performing Vulnerability Analysis
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index.js:74
Finding: Protected-Skill Warnings Are Unconditionally Counted as Passing Checks
Content: View full analysis
0) { result.status = 'warning'; } return result; ``` ### Technical Analysis `checkProtectedSkills` records absent protected skills in `result.missing` and changes its status to `warning`. The aggregation logic in `generateDashboard` ignores that returned status and increments `dashboard.summary.passed` for every non-throwing invocation. Overall health is later derived from the aggregated `critical` and `warnings` counters. Because the protected-skills warning is not added to `dashboard.summary.warnings`, the dashboard can report `overallHealth: 'healthy'` and award pass-score credit while its detailed protected-skills result says `warning`. This creates an inconsistent and potentially bypassable health decision: the detailed check detects the condition, but the top-level security signal used by `isHealthy()` fails to enforce it. ### Attack Path 1. An attacker, compromised process, or mistaken administrator with write access removes or renames one or more entries from the hard-coded protected-skill list. 2. `checkProtectedSkills` detects the missing skill and returns `status: 'warning'`. 3. `generateDashboard` i ...[truncated 988 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill advertises dependency security monitoring, but the implementation only parses package.json and counts dependencies without checking versions against any advisory source. This can mislead operators into believing a security scan occurred, causing vulnerable packages to go undetected and weakening security decisions made from the dashboard.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The inline comment at L84 states 'Always pass if no error', but checkProtectedSkills explicitly sets result.status = 'warning' when any protected skills are missing. This is an active contradiction between code documentation and behavior, and it also causes the summary logic to record a pass regardless of the returned warning state.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.