Security audit

SlipBot

Security checks for vulnerabilities and agentic risk

Overview

Slipbot is a coherent note-capture skill, but its very broad auto-trigger can cause persistent local note and graph changes without clear confirmation.

Review this skill before installing if you often type Markdown lists, quotes, or journal-like messages. It should ideally use an explicit capture command or ask before writing, and it should avoid reading USER.md for timezone unless you deliberately allow that.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:12
Finding: Excessive Access to Persistent User Profile Data## Vulnerability Details **File Location**: `SKILL.md`, line 12 **Vulnerability Type**: Least-privilege violation through unnecessary profile-file access **Risk Level**: Medium **Complete Code Snippet**: ```markdown - **Timezone:** User's local timezone (check USER.md or system) ``` ### Technical Analysis The instruction permits the agent to read `USER.md` merely to determine the user's timezone. A persistent user profile or memory file may contain identity details, preferences, historical context, or other personal information unrelated to note timestamp generation. This access exceeds the minimum privileges needed for the task. The timezone can ordinarily be obtained from the operating system, an existing trusted configuration value, or a direct user prompt. Although the Skill does not instruct the agent to transmit or disclose the retrieved information, loading unrelated profile data into the active context unnecessarily expands the sensitive-data exposure boundary. ### Attack Path 1. The user invokes the Skill to capture a note. 2. The Skill needs the local timezone to generate the note's timestamp. 3. Following the instruction at line 12, the agent reads `USER.md`. 4. Unrelated persistent user information from that file enters the agent's active context. 5. That information may subsequently influence note processing or be unintentionally reflected in generated content or responses. No external exfiltration mechanism or deliberate disclosure instruction was identified in the audited file. ### Impact Assessment The agent may obtain read access to persistent user-profile information beyond what note capture legitimately requires. The affected scope is limited to data available in `USER.md` and its possible exposure within the current agent context. The audited Skill does not establish privilege escalation to broader system control, code execution, persistence, or network-based data exfiltration.
Remediation: ## Remediation Suggestions 1. Remove the instruction to inspect `USER.md`. 2. Obtain the timezone from the operating system or runtime's trusted local-time configuration. 3. If the system timezone is unavailable or ambiguous, ask the user to provide or confirm an IANA timezone identifier. 4. Add an explicit least-privilege rule prohibiting access to profile, memory, credential, and unrelated configuration files solely for timestamp generation. 5. Restrict Skill file operations to the declared `{curDir}/slipbox/` directory except where the user expressly authorizes additional access. A safer replacement is: ```markdown - **Timezone:** Use the operating system's local timezone. If unavailable, ask the user; do not read user profile or memory files to determine it. ```

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to create and modify files in the user's working directory and slipbox without any explicit confirmation or clear user-facing notice that persistent filesystem changes will occur. Because the skill auto-activates on common note-like prefixes, a user may unintentionally trigger writes, causing silent persistence of data and unexpected modification of local files.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to remove graph entries and clear tracking data from missing.md based on file existence checks, but it provides no safeguard, backup, or confirmation before destructive updates. If triggered incorrectly or if files are temporarily unavailable, the agent could silently delete index information and erase recovery context, making notes harder to restore or audit.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The activation rule applies whenever user content starts with very common characters such as '-', '*', '!', or '>', which are frequently used in ordinary chat, markdown, lists, emphasis, or quoted text. This broad trigger materially increases the chance of unintended invocation, causing accidental note capture and downstream file writes or graph mutations without the user's clear intent.

Static analysis

No suspicious patterns detected.