Automation Workflows Litiao

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:17 AM UTC
• Version: 1.0.0

Overview

This is a coherent no-code automation playbook, but users should apply extra care when workflows touch customer, payment, or public-posting systems.

Before installing or using this skill, treat workflows involving customer records, payment data, email campaigns, Slack notifications, or public social posts as sensitive: limit connected-app permissions, minimize shared fields, test mappings with safe sample data, add approval steps for high-impact actions, and monitor logs after enabling automations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad, common phrases such as "automate," "automation," and "save time," which can cause the skill to activate in unrelated conversations. Over-broad invocation increases the chance the agent surfaces this skill unexpectedly and takes workflow-oriented actions in contexts where the user did not clearly request automation help.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guidance encourages automations that transfer customer, financial, and operational data across CRMs, spreadsheets, email tools, payment systems, and Slack without explicit safeguards for privacy, access control, consent, or data validation. This can lead users to build workflows that leak sensitive data, mishandle customer information, or corrupt records through bad mappings and unchecked propagation.

Session Persistence

Medium

• Category: Rogue Agent

Content

2. Flag customers with <50% of average usage
  3. Add flagged customers to "At Risk" segment in CRM
  4. Send re-engagement email campaign to at-risk customers
  5. Create task for me to personally reach out to top 10 at-risk customers
```

### Invoice and payment tracking

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.