Security audit

idea-manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local idea-list manager whose file writes, deletes, archives, and reindexing behavior are disclosed and fit its stated purpose.

Use this if you want a local IDEAS.md manager. Be deliberate with delete, archive, archive --force, and --file; keep backups for important idea lists and avoid pointing --file at anything that is not meant to be rewritten as an ideas file.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.
md
- `scripts/` — Contains the Python implementation (`idea_manager.py`)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README encourages invocation from broad natural-language prompts like 'show idea list', 'review ideas', or 'add new idea', which can overlap with ordinary conversation and cause unintended tool activation. Because this skill performs persistent file writes, deletes, and archival operations, ambiguous triggering increases the chance of accidental state-changing actions from casual user phrasing.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Documenting archive --force as a way to skip confirmation exposes a fully non-interactive destructive path for archiving and reindexing entries, including rewriting references and creating archive files. In an agent setting, this can enable autonomous execution of irreversible state changes without an explicit contemporaneous user confirmation, increasing the risk of unintended data loss or integrity changes.
Content: Scanner excerpt · README.md (reported line 120)May include surrounding context.
bash
python3 scripts/idea_manager.py archive python3 scripts/idea_manager.py archive --archive-details python3 scripts/idea_manager.py archive --force # skip confirmation

Moves matching entries from IDEAS.md to memory/IDEAS-Archive-YYYY-MM-DD.md, removes them from IDEAS.md, and reindexes the remaining entries sequentially (IDEA-001, IDEA-002, …). Any related_files references are updated automatically to reflect the new IDs.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill explicitly performs file reads and writes, including destructive operations on IDEAS.md and archive files, but does not declare any tool scope or permissions boundary. Without an allowlist or permissions metadata, the runtime may grant broader filesystem access than users expect, increasing the chance of unintended or abusive file modification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description uses broad, natural-language triggers like 'add new idea' or 'review ideas', which can cause the skill to activate during ordinary conversation rather than from a clearly scoped intent. Because this skill can modify and delete files, accidental activation can lead to unintended state changes or data loss.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The examples encourage triggering the skill from everyday phrasing such as 'Add a new idea...' and 'Show me the list of my ideas' without a strict activation contract. In an agent environment, that increases the risk that normal discussion is interpreted as authorization to read or rewrite user data files.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 84% confidence
Finding: The quick reference advertises a 'without confirmation' archive mode for a destructive operation that removes completed items and reindexes IDs. In an automated agent context, easy access to a force flag can bypass a meaningful safety checkpoint and amplify accidental or unauthorized data changes.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
| Delete an idea | `idea-manager delete --id IDEA-001 --decision "Replaced by LRN-20260822-001"` | | Archive completed items (metadata only) | `idea-manager archive` | | Archive completed items (with full details) | `idea-manager archive --archive-details` | | Archive without confirmation | `idea-manager archive --force` | | See summary stats | `idea-manager status` | | Export stats as JSON | `idea-manager status --json` | | Export as JSON | `idea-manager read --json` |

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: The archive workflow documents skipping the confirmation prompt for an irreversible operation in non-interactive use. Since archive both moves data and reindexes remaining entries, bypassing confirmation increases the chance of silent destructive changes, especially if the skill is triggered too broadly or chained in automation.
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
Include full entry details in the archive file

idea-manager archive --archive-details

Skip confirmation prompt (for scripts/non-interactive use)

idea-manager archive --force

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The delete action removes an entry from IDEAS.md and immediately writes the updated file without any confirmation prompt or explicit warning about the destructive change. Although the code prints a message after deletion, there is no pre-action disclosure in the function docstring, comments, or runtime flow to warn the user before data is removed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The archive command does more than archive completed ideas: it renumbers every remaining entry ID and rewrites references in related_files. This creates a dangerous integrity and drift issue because IDs are durable identifiers that may be referenced externally in docs, scripts, tickets, or human workflows, so archiving one item can silently break downstream references and exceed the skill’s stated behavior.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/idea_manager.py (reported line 658)May include surrounding context.
python
archive_parser = subparsers.add_parser('archive', help='Archive completed entries, reindex remaining') archive_parser.add_argument('--status', help='Filter by status (default: completed)') archive_parser.add_argument('--archive-details', action='store_true', help='Include full entry details in the archive file (default: metadata only)') archive_parser.add_argument('--force', '-f', action='store_true', help='Skip confirmation prompt') archive_parser.set_defaults(func='archive') # Edit command

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The global --file option allows the tool to read from and write to arbitrary user-specified paths, not just IDEAS.md in the managed workspace. In an agent setting, this broadens the skill from idea management to a general file modification primitive, enabling unintended overwrite, deletion, or corruption of sensitive files if an attacker can influence arguments or prompts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

SkillSpector

Ae1

Vague Triggers

Autonomous Decision Making

Undeclared Tool Scope

Vague Triggers

Vague Triggers

Autonomous Decision Making

Autonomous Decision Making

Include full entry details in the archive file

Skip confirmation prompt (for scripts/non-interactive use)

Missing User Warnings

Description-Behavior Mismatch

Autonomous Decision Making

Description-Behavior Mismatch

Static analysis