Security audit

Multi-Topic Board

Security checks for vulnerabilities and agentic risk

Overview

The skill is for topic tracking, but it automatically sets up persistent background agent jobs and workspace memory without explicit user consent or a clear removal path.

Install only if you intentionally want a workspace-level topic memory with recurring background checks. Before using it, confirm the exact cron jobs, files, session access, retention period, sensitive-topic exclusions, and removal steps; avoid using it for confidential discussions unless those controls are clear.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

Location: SKILL.md:78
Finding: Persistent Recurring Agent Execution Through Scheduled Jobs
Content: View full analysis
0 → sessions_send to main: list timed-out topics, suggest creating tasks in tasks/\n" }, "sessionTarget": "isolated", "delivery": { "mode": "none" } } ``` ```json { "schedule": { "kind": "every", "everyMs": 86400000 }, "payload": { "kind": "agentTurn", "message": "【Daily Multi-Topic Board Maintenance】\n\nStep 1: Update aging days\n- Read memory/multi-topic.md\n- For each 🔥 Pending entry: today - discovered_at = days\n- IF no days field → append to entry\n- IF days changed → update in place\n- Write back to multi-topic.md (only touch the days field)\n\nStep 2: Timeout stats and alert\n- Count entries: days >= 3 AND task = none\n- IF > 0 → sessions_send to main: N topics 3+ days with no task: [topic names]\n- IF = 0 → silent end\n" }, "sessionTarget": "isolated", "delivery": { "mode": "none" } } ``` ### Technical Analysis The bootstrap procedure creates cross-session behavior rather than limiting execution to an explicit, current-session invocation. The recurring jobs are configured to: - Run autonomous agent turns every four hours and ...[truncated 2657 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is explicitly designed for cross-session topic tracking, aging, reminders, and notifications, but it does not disclose retention, review scope, or privacy implications of storing unresolved discussion topics in persistent memory and surfacing them across sessions. This is risky because sensitive project details, personal information, or confidential decisions could be retained longer than the user expects and reintroduced automatically in future contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs the agent to create and modify multiple workspace files and directories (tasks/, memory/multi-topic.md, HEARTBEAT.md) as part of bootstrap and ongoing operation, but it does not require explicit user consent or even a warning before making those changes. This is dangerous because a user may invoke the skill for informational tracking and unintentionally authorize persistent filesystem changes and scheduled automation that alter the workspace over time.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.