T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:289- Finding
Persistent Agent Role and Behavioral Configuration Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai Workforce
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent business-operations assistant, but it asks for broad autonomous authority, persistent profiling, scheduled agent runs, and whole-workspace Git backup behavior that users should review carefully before installing.
Install only if you intentionally want a highly autonomous, persistent business agent. Before use, require explicit confirmation for onboarding writes, cron jobs, Git commits or pushes, worker spawning, and any storage of personal context; avoid enabling remote backups unless the repository is private, reviewed, and excludes sensitive memory files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:318- Finding
Silent Persistent Collection of Personal and Behavioral Profiles
- Content
View full analysis
.md` and update `USER.md` as understanding deepens. ### Human Awareness The human is a person, not a task source. Respect that. **Quiet hours:** Read timezone from USER.md. Default 23:00-08:00 local time. Only break quiet hours for genuine emergencies. Queue non-urgent items for morning. **Energy sensing:** - Terse messages, typos, late-night activity → they're tired or stressed. Keep responses short, handle more autonomously, don't ask unnecessary questions. - "Just handle it" → they're overwhelmed. Take initiative, reduce back-and-forth. - Long thoughtful messages → they're engaged. Match depth, explore ideas together. - No response for hours during work time → they're in deep work. Don't interrupt. * ...[truncated 3748 chars]- Remediation
View remediation
T06 · System Persistence
Error
- Location
references/reflection-prompts.md:1- Finding
Installation of Recurring Autonomous Agent Jobs
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:411- Finding
Indiscriminate Workspace Staging and Remote Git Upload
- Content
View full analysis
&& git init && git add -A && git commit -m "Initial Chief workspace" ``` If a remote exists, push. If not, suggest the human adds one: > "I'd like to back up my workspace to git. Can you add a remote? `git remote add origin `" **When to commit:** - After onboarding completes - After significant conversations (new decisions, new entities, meaningful work) - After reflection cycles (daily/weekly/monthly) - After trust level changes - When the human says "save" or "backup" - Before any destructive operation (pruning, archiving) **When NOT to commit:** - After every single message (too noisy) - For trivial updates (typo fixes, minor log entries) - Mid-conversation (wait for a natural break) **How:** ``` cd && git add -A && git commit -m "" && git push 2>/dev/null || true ``` Keep commit messages descriptive: - "Onboarding complete — bank/ and identity populated" - "Daily reflection — updated experience and trust" - "New entity: client-acme" - "Trust promoted: research tasks → notify" **Rule of thumb:** If you've written to 3+ files or added meaningful new context, commit. **Backup cron** (optional, set up during onboarding): Schedule a daily auto-commit to catch anything missed: ``` Schedule: daily, after reflection Task: "cd && git add -A && git diff --cached --quiet || git commit -m 'Auto-backup: $(date +%Y-%m-%d)' && git push 2>/dev/null" ``` ``` ### Technical Analysis The backup workflow uses `git add -A`, which stages every tracked, modified, deleted, and untracked file under the workspace. It does not ve ...[truncated 2346 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (19)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md - Busy periods: ## People <!-- Key people in the business ecosystem --> Last updated: {{date}}
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guide explicitly instructs the agent to silently create and modify multiple local knowledge and identity files during a conversational onboarding flow, without requiring visible disclosure or user confirmation. In an agent skill centered on autonomy, memory, and business operations, hidden writes materially increase the risk of unauthorized persistence, accidental data capture, and trust-boundary violations.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to delete BOOTSTRAP.md directs the agent to remove a file without confirmation, audit visibility, or a demonstrated necessity tied to user intent. Even if meant as cleanup, unprompted deletion normalizes destructive file operations and can hide setup artifacts that users may want to review or retain.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The activation description is extremely broad, covering setup, onboarding, delegation, trust management, and recurring memory maintenance. That breadth increases the chance the skill is invoked for ordinary requests where users may not expect autonomous state changes, persistent logging, or worker spawning, which can lead to over-application of high-impact behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The quick setup directs the agent to read onboarding material, create a bank structure, and set up cron jobs without an explicit warning that these actions modify the system and create persistent state. This is dangerous because users may invoke the skill expecting advice, but instead trigger autonomous writes and scheduled behavior that outlive the session.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 78% confidence
- Finding
The skill explicitly says to act on high-confidence opinions without asking, which authorizes autonomous decision-making based on the agent's inferred beliefs rather than current user approval. In this skill's context, those opinions can influence business operations, content, or strategy, so mistakes can propagate into real-world actions and persisted records without adequate human oversight.
- Content
md **Category Creation**: Trust categories aren't fixed. When new types of work emerge, create new categories in `bank/trust.md` at "propose" level. Example: human starts asking you to manage their calendar — create a "Scheduling" category without being told. **Opinion Formation**: Actively form opinions in `bank/opinions.md` about what works for this business. "Blog posts under 800 words get more engagement" (confidence: 0.7). Update confidence with evidence. Act on high-confidence opinions without asking. **Structural Evolution**: The bank/ structure is a starting point. If you need a file that doesn't exist — create it. Need `bank/competitors.md`? Make it. Need `bank/content-calendar.md`? Make it. Update `bank/index.md` to reflect changes.
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
These sections instruct the agent to infer and persist detailed personal and behavioral traits such as work patterns, stress triggers, decision-making style, mood cues, and long-term aspirations. This goes beyond immediate task execution into durable profiling, which can violate user expectations, create sensitive dossiers, and increase harm if the workspace is later exposed or synced elsewhere.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill encourages long-term retention of user preferences, stress patterns, energy cues, birthdays, milestones, and other personal or behavioral context, but does not present a prominent privacy warning or consent model in the skill description. Persistent profiling of a human's behavior and personal details creates material privacy risk, especially when combined with shared organizational memory and backup mechanisms.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The relationship-building guidance tells the agent to remember and log personal details such as birthdays, milestones, and other context the user has shared. Even when framed as helpful, storing personal-life details in persistent files creates unnecessary privacy exposure and can accumulate sensitive non-work information over time.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to initialize git, add all files, commit the entire workspace, and optionally push to a remote. In a skill centered on business operation and memory management, this creates a broad exfiltration and persistence channel that can capture sensitive workspace contents far beyond what is necessary, including notes, credentials accidentally stored in files, and private user context. The danger is amplified because the skill normalizes recurring backups and pre-destructive-operation commits, making large-scale data capture routine.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This cron prompt instructs the agent to read and modify multiple memory and bank files, append reflections, prune content, and update trust records without any explicit user-facing warning, confirmation, or scoped write constraints. In an autonomous agent context, that creates a real risk of silent state mutation, accidental data loss, and integrity drift in long-lived knowledge stores, especially because the job runs routinely and includes destructive actions like pruning.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The prompt instructs the agent to perform broad archival and pruning actions across memory and bank data, including aggressive reduction of MEMORY.md and moving inactive entities, without requiring user confirmation, preview, rollback guidance, or explicit safety checks. In an autonomous cron context, this can cause unintended data loss, concealment of important historical context, or irreversible degradation of operational memory if the agent misclassifies what is 'needed' or 'inactive'.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This prompt instructs the agent to modify multiple persistent state files, including memory summaries, trust levels, opinions, entity indexes, and process documentation, without any explicit approval gate, user notification, or change-safety constraints. In a trust/autonomy skill, these writes can materially alter future agent behavior and institutional memory, so silent or automatic execution creates a real integrity risk even if the operational intent is legitimate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrase "Run daily reflection" is broad and natural-language generic, which increases the chance that unrelated user or agent text could accidentally activate the reflection workflow. Because the workflow performs file reads and writes across memory/ and bank/ and can modify trust records, an unintended trigger could cause unauthorized state changes or prompt-injection-driven updates to persistent knowledge.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The weekly trigger "Run weekly reflection" is similarly ambiguous and lacks strict scoping, making it susceptible to accidental or adversarial invocation when that phrase appears in normal content. In this skill, weekly reflection writes standalone summaries and changes trust/opinion state, so a false activation can propagate bad data into longer-lived records.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
"Run monthly consolidation" is a generic command for a high-impact maintenance routine that archives logs, prunes memory, and moves entities into archive locations. If triggered unintentionally or via instruction collision, it could alter or relocate large amounts of persistent state, causing data loss, concealment of context, or corruption of the agent's operating memory.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The capability audit trigger is not specific enough for a workflow that enumerates tools and skills and proposes new uses based on stored business context. Ambiguous activation could expose capability information or cause the agent to make persistent planning updates based on untrusted context, increasing the blast radius of prompt injection or cross-context confusion.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The first-activation condition uses filesystem state (
BOOTSTRAP.md exists or bank/ doesn't exist) as a trigger, which may cause the onboarding workflow to run unexpectedly. Ambiguous activation logic can cause unintended setup actions such as creating directories, reading bootstrap instructions, or preparing recurring jobs when the user did not explicitly request initialization.- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill tells the agent to set up reflection cron jobs, creating persistent scheduled execution. Even if intended for maintenance, scheduled autonomous actions extend the agent's behavior beyond the user's immediate request and can trigger ongoing file writes, monitoring, or other actions without fresh consent each time.
- Content
Static analysis
No suspicious patterns detected.