Security audit

Agent Ops

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned agent-ops guidance, but it needs review because its optional daemon and rollback patterns can read sensitive transcripts, persist recovered notes, and mutate repository state without strong user-control safeguards.

Install only if you want an advanced agent-operations reference and are prepared to configure it carefully. Do not enable the daemon, transcript recovery, tmux key-sending, or rollback hooks globally; scope them to known sessions and repositories, require confirmation for destructive commands, log actions, and avoid archiving raw transcripts or thinking blocks without redaction and retention limits.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The skill uses broad operational trigger language such as 'agent monitoring' and 'session ops,' which can cause the skill to activate in routine conversations where the user did not intend operational automation. Because this skill references recovery, rollback, daemons, and model fallback, overbroad triggering increases the chance of unintended high-impact actions being suggested or invoked in the wrong context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill describes automated checkpointing, rollback, daemonized stale-session handling, and model fallback, but it does not present a clear warning that some operations may alter state, discard work, or trigger recovery actions automatically. In an ops-oriented skill, failing to warn users about destructive or semi-destructive behaviors materially raises the risk of accidental data loss, incorrect rollback, or unintended session manipulation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The pattern explicitly instructs the daemon to analyze dead-session transcript files and especially 'thinking blocks' to extract unsaved findings. Those transcripts can contain sensitive user data, secrets, internal reasoning, or other confidential material, and the document provides no consent, minimization, redaction, retention, or access-control safeguards. In an ops skill focused on automated session recovery, this makes the issue more dangerous because the behavior is framed as routine background processing and archival, increasing the chance of silent large-scale collection of sensitive data.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The pattern automates recovery around destructive Bash operations but does not require an explicit user confirmation or approval gate before those operations run. In an agent-ops skill, this is risky because rollback reduces perceived danger and may encourage execution of commands like rm -rf or kubectl delete without sufficient human review, while rollback cannot reliably undo all side effects.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: CMD=$(echo "$INPUT" | jq -r '.tool_input.command // ""') # 检测破坏性命令 if echo "$CMD" | grep -qE 'rm -rf|git reset --hard|git checkout --|docker rm|kubectl delete'; then # 创建快照（先 git add -A 让 untracked 文件进入 index，再 stash create） # 注意：git stash create 不支持 --include-untracked，只有 push/save 支持 git add -A 2>/dev/null
Confidence: 87% confidence
Finding: The hook inspects raw Bash command text with a broad regex and then allows execution to proceed by default, only recording a checkpoint. In an agent-ops skill that may mediate real shell usage, this creates dangerous reliance on pattern matching: destructive commands may bypass detection, benign commands may be misclassified, and automatic rollback does not protect against external side effects such as container, cluster, or remote resource deletion.

Static analysis

No suspicious patterns detected.