Agent Ops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:04 AM UTC
• Version: 1.1.0

Overview

The skill is not overtly malicious, but it documents automation that can retain sensitive session transcripts and change repositories without clear opt-in or safeguards.

Install only if you intend to use local agent-operations patterns and can review each hook or daemon before enabling it. The context-usage script alone is narrow, but do not enable transcript scavenging or automatic git rollback unless you add explicit opt-in, private file permissions, secret redaction, retention limits, confirmation before state changes, and reliable rollback/error handling.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/17-stale-session-daemon.md:11

Finding

Stale-session scavenging can persist sensitive transcript content without adequate access controls

Content

View full analysis

"sessions/${SESSION_ID}/heartbeat" ``` ```bash # Check all session heartbeats every minute NOW=$(date +%s) for dir in sessions/*/; do SESSION=$(basename "$dir") HEARTBEAT_FILE="$dir/heartbeat" [ -f "$HEARTBEAT_FILE" ] || continue LAST=$(cat "$HEARTBEAT_FILE") AGE=$(( NOW - LAST )) if [ "$AGE" -gt 300 ]; then # No heartbeat for five minutes # Check whether the tmux session still exists if ! tmux has-session -t "$SESSION" 2>/dev/null; then # The session is dead; scavenge its knowledge echo "Scavenging dead session: $SESSION (${AGE}s stale)" # Extract important information from the transcript # ...write to sessions/$SESSION/handoffs/scavenged.md echo "scavenged" > "$dir/status" fi fi done ``` ### Technical Analysis The proposed daemon is designed to inspect stale-session transcripts, including private reasoning blocks, and persist extracted content in an archive. The design does not specify: - Explicit per-session authorization or opt-in. - Validation that a transcript belongs to the current user or daemon. - Restrictive permissions for session directories and archive files. - Secret, credential, personal-data, or source-code redaction. - Data-retention and secure-deletion requirements. - Protection against symbolic links or attacker-controlled session directories. - A rule preventing hidden reasoning from being collected. A process ...[truncated 2036 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/19-checkpoint-rollback.md:25

Finding

Git checkpoint procedure alters the index, stores untracked secrets, and cannot reliably roll back destructive commands

Content

View full analysis

/dev/null CHECKPOINT=$(git stash create 2>/dev/null) git reset HEAD 2>/dev/null # Restore the index to its original state if [ -n "$CHECKPOINT" ]; then echo "$CHECKPOINT" > "sessions/${SESSION_ID}/checkpoint" # PreToolUse does not support additionalContext; only permissionDecision # Record the checkpoint without modifying tool behavior fi fi # No JSON output means that the tool is allowed to execute ``` ```bash INPUT=$(cat) CHECKPOINT_FILE="sessions/${SESSION_ID}/checkpoint" [ -f "$CHECKPOINT_FILE" ] || exit 0 CHECKPOINT=$(cat "$CHECKPOINT_FILE") git stash apply "$CHECKPOINT" 2>/dev/null rm -f "$CHECKPOINT_FILE" echo '{"hookSpecificOutput":{"additionalContext":"Auto-rolled back to checkpoint after tool failure."}}' ``` ### Technical Analysis The checkpoint procedure stages the entire working tree with `git add -A`. This has two important security and integrity consequences: 1. Untracked files—including environment files, credentials, private keys, generated secrets, and ignored-policy mistakes—may be written into Git objects by `git stash create`. 2. `git reset HEAD` does not restore the index to its exact previous state. Files that were intentionally staged before the hook can become unstaged. The generated stash object may remain recoverable from the Git object database until garbage collection, even if no named stash reference is created. Consequently, sensitive untracked c ...[truncated 2356 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad agent session operations tool covering operational recovery workflows, dead-session handling, automatic snapshots/checkpoints, and context-budget monitoring. The supplied code only implements a narrow utility: it validates a transcript file, reads the last JSONL entry, extracts .usage.input_tokens with jq, and prints that raw token count when available. It explicitly states that transcripts do not include context_window_size and that it cannot compute a usage percentage. Therefore, while there is a partial relationship to 'token budget' via reporting input tokens, the actual behavior is far narrower than the declared purpose and lacks most of the advertised capabilities. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/19-checkpoint-rollback.md (reported line 5)May include surrounding context.

md

## 问题

Agent 执行 Bash 命令可能造成不可逆的破坏——`rm -rf`、`git reset --hard`、`docker rm`。Claude Code 内置的 checkpoint 只追踪 Write/Edit 工具的文件变更，不覆盖 Bash 的副作用。

来源：Claude Code 官方文档 Checkpointing + PostToolUseFailure hook

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

The hook inspects raw Bash command text with a broad regex and then performs privileged repository actions automatically when matched. In an agent-ops skill, coupling destructive-command detection to implicit git operations is dangerous because command text can be matched unexpectedly, shell input can be ambiguous, and the hook may alter repository state even for non-executed, commented, or malformed command strings.

Content

Scanner excerpt · references/19-checkpoint-rollback.md (reported line 24)May include surrounding context.

md

CMD=$(echo "$INPUT" | jq -r '.tool_input.command // ""')
# 检测破坏性命令
if echo "$CMD" | grep -qE 'rm -rf|git reset --hard|git checkout --|docker rm|kubectl delete'; then
  # 创建快照（先 git add -A 让 untracked 文件进入 index，再 stash create）
  # 注意：git stash create 不支持 --include-untracked，只有 push/save 支持
  git add -A 2>/dev/null

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises shell-capable operational behaviors such as scripts, cron, daemons, rollback, and tmux interaction, but does not declare any tool scope or permission boundary. In an agent environment, missing explicit allowed-tools/permissions increases the chance of unintended shell execution or overbroad access because consumers cannot reliably constrain what the skill is expected to do.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Presenting hook scripts as built-in tools after instructing users not to use the skill for hook scripts creates a dangerous documentation conflict. In security-sensitive agent systems, contradictory instructions can cause unauthorized hook execution, accidental persistence, or unexpected prompt/session manipulation because operators may misunderstand the actual operational boundary.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation says this skill is not for installing hook scripts, yet the built-in tool list includes multiple hook-script capabilities such as checkpoint/rollback, token budget injection, and model fallback. This inconsistency can mislead users or downstream agents into enabling or using hook-based automation they believed was out of scope, increasing the risk of silent state changes or policy bypass.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill describes automatic recovery, rollback, session cleanup, and model switching without a clear warning that these actions may modify active tmux sessions, session state, prompts, or repository state. In context, this is more dangerous because the skill is explicitly operational and automating: users may trigger destructive or hard-to-audit changes under the assumption that it is only monitoring or advising.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The entire skill description and operational guidance are written in Chinese, with no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. This is a natural-language locale policy concern because it imposes a specific language by default rather than offering opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file presents all operational guidance in Chinese, and it does not indicate that the skill is region-specific or that users may opt into another language. That creates a natural-language policy concern because it effectively forces a specific language for understanding and use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language instructions and descriptions in this file are entirely in Chinese, which effectively forces a specific language for users reading or operating the skill documentation. Under the stated policy, a language constraint should be optional or explicitly justified rather than imposed without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The pattern explicitly proposes analyzing dead-session transcripts, including thinking blocks, and archiving extracted findings without any notice, consent boundary, retention policy, or minimization guidance. Those artifacts can contain sensitive user data, secrets, and internal reasoning, so automated scavenging materially increases privacy and data-handling risk in an operations tool that may run across many sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The pattern proposes automatically applying a git stash on tool failure, which changes repository working tree state and can overwrite or conflict with the user's current changes without an explicit warning or confirmation step. In an agent-ops skill, silent rollback behavior is particularly risky because it is triggered around destructive shell operations and may cause unexpected state transitions or loss of user work during recovery flows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document is written entirely in Chinese, including headings, instructions, and examples, with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking context. This creates a natural-language locale policy concern because it implicitly constrains usage to one language without user opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_context_usage.py (reported line 18)May include surrounding context.

python

with tempfile.NamedTemporaryFile(mode='w', suffix='.jsonl', delete=False) as f:
        f.write(transcript_content)
        f.flush()
        result = subprocess.run(
            ["bash", str(SCRIPTS_DIR / "context-usage.sh"), f.name],
            capture_output=True, text=True, timeout=10,
        )

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The skill description and operational guidance are predominantly written in Chinese, with no statement that users may choose their preferred language or locale. Under the policy, language constraints should be optional or explicitly justified rather than implicitly imposed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file's natural-language instructions and headings are presented entirely in Chinese, which can impose a language requirement on users without opt-in. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless explicitly justified as locale-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This markdown file presents the skill documentation primarily in Chinese while embedding English command text and warning strings, but it does not state any user language choice or opt-in. Under the policy rule, forcing a specific language or locale without user selection can be a natural-language policy concern.

Content

No source excerpt is available for this finding.