T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:24- Finding
Mutable External Repositories and Unverified Dependencies Are Executed Locally
- Content
View full analysis
- Remediation
View remediation
Security audit
TimeCamp
Security checks for vulnerabilities and agentic risk
Overview
This TimeCamp skill is mostly coherent, but it asks agents to run unpinned external code and can access sensitive team activity data with limited privacy controls.
Review this before installing. Use it only if you trust the TimeCamp GitHub repositories and are comfortable with the agent accessing TimeCamp data, including team-wide timesheets and computer activity records. Prefer pinning reviewed commits, avoiding global npm link, using a least-privilege API key, and requiring explicit confirmation before fetching all-user or activity-monitoring datasets.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger description includes very broad terms such as "tracking," "hours," "tasks list," and "activities," which can match many ordinary workplace requests that are unrelated to TimeCamp. This increases the chance of accidental skill invocation and unintended access to time-tracking or employee-activity tooling, especially because the skill supports fetching organization-wide entries and computer activity data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill exposes analytics workflows over sensitive datasets including all users' entries, user details, and computer activity/application usage, but it does not prominently warn about the privacy sensitivity or require elevated confirmation before accessing them. In context, this makes accidental or inappropriate retrieval of employee monitoring data more likely, especially when combined with broad triggers and examples that normalize bulk fetches and cross-user reporting.
- Content
Static analysis
No suspicious patterns detected.