workspace-manager

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:56 AM UTC
• Version: 1.0.0

Overview

This workspace-management skill needs review because its full pipeline can move local files and upload broad workspace contents, including memory/config files, to Google Drive despite a claimed dry-run mode.

Install only after reviewing the scripts and only if you intentionally want this skill to reorganize workspace files and potentially sync data to Google Drive. Do not rely on --dry-run as non-mutating in this version; disable sync_human and sync_backup, remove or unauthenticate gog, or avoid --all until the dry-run, sync opt-in, config parsing, and overwrite-collision issues are fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/pipeline.sh:90
• Finding: Dry-run mode performs local mutations and cloud uploads<![CDATA[ ## Vulnerability Details **File Location**: `scripts/pipeline.sh:90-99, 114-130`; related defaults in `config/sync-config.json:2-4` and upload operations in `scripts/sync.sh:54-62, 90-104` **Vulnerability Type**: Dry-run contract violation and unintended data disclosure **Risk Level**: High ### Vulnerable Code ```bash organize) log "📂 Step 2/5: Running file organizer..." if bash "$SCRIPT_DIR/organize.sh" 2>&1 | tee -a "$STEP_LOG"; then pass "Organize complete" else warn "Organize completed with warnings" fi ;; ``` ```bash sync) log "☁️ Step 5/5: Running cloud sync (optional)..." # Sync is optional - don't count as failure if skipped if bash "$SCRIPT_DIR/sync.sh" 2>&1 | tee -a "$STEP_LOG"; then pass "Sync complete" else SYNC_EXIT=${PIPESTATUS[0]} if [ $SYNC_EXIT -eq 0 ]; then pass "Sync skipped (gog not configured)" else warn "Sync completed with warnings" fi fi ;; ``` The default synchronization configuration enables human workspace and core-file uploads: ```json { "sync_human": true, "sync_agent": false, "sync_backup": true, "output_folder": "AI_Workspace", "backup_folder": "AI_Workspace_Backup", "_comment": "Set sync_human/sync_agent to true to enable, false to skip. Requires gog CLI installed and authenticated." } ``` The corresponding upload operations are: ```bash if [ "$SYNC_HUMAN" = "true" ] && [ -d "$HUMAN" ]; then echo "📁 Syncing Workspace_Human/..." echo " → $OUTPUT_FOLDER/Workspace_Human/" FILE_COUNT=$(find "$HUMAN" -type f 2>/dev/null | wc -l || echo 0) echo " Files: $FILE_COUNT" if [ "$FILE_COUNT" -eq 0 ]; then echo " ℹ️ Nothing to sync" elif gog drive sync upload "$HUMAN/" ...[truncated 2382 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Enforce dry-run centrally so that every mutating or networked stage is skipped or receives an explicit dry-run flag. - Do not invoke `sync.sh` at all when `DRY_RUN=true`. - Add dry-run support to `organize.sh` that reports proposed source and destination paths without calling `mv`. - Require an explicit option such as `--sync`; do not include cloud synchronization implicitly in a default or dry-run pipeline. - Change synchronization defaults to false, especially for core memory, identity, and user-profile files. - Before any upload, display the exact files, destination account, and remote folder, then require explicit confirmation. - Add automated tests asserting that dry-run causes no filesystem metadata changes and no external process capable of network transmission is invoked. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sync.sh:14
• Finding: Arbitrary shell command execution through sourced JSON configuration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/sync.sh:14-17` **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash # Load optional config CONFIG_FILE="$SKILL_DIR/config/sync-config.json" if [ -f "$CONFIG_FILE" ]; then source <(jq -r 'to_entries | .[] | "SYNC_\(.key|ascii_upcase)=\(.value)"' "$CONFIG_FILE" 2>/dev/null || true) fi ``` ### Technical Analysis The script transforms every JSON key and value into shell assignment text and then executes that text with Bash `source`. Neither keys nor values are shell-escaped, and there is no allowlist restricting accepted configuration fields. A value containing command substitution or other shell syntax becomes executable shell code. For example, an attacker-controlled value such as `"$(id > /tmp/proof)"` can be rendered as an assignment whose command substitution is evaluated when the generated stream is sourced. Malicious keys can likewise alter the generated shell grammar. This is not merely unsafe parsing: `source` treats configuration data as executable code. ### Attack Path 1. An attacker, compromised update, or lower-trust process obtains write access to `config/sync-config.json`. 2. The attacker inserts shell syntax into a key or value, for example a command substitution in `output_folder`. 3. A user or Agent runs `scripts/sync.sh`, directly or through the default pipeline. 4. `jq` converts the malicious JSON entry into unquoted shell source text. 5. Bash `source` parses the generated text and executes the injected command. 6. The payload runs with all filesystem, process, credential, and network permissions held by the invoking user. ### Impact Assessment Successful exploitation provides arbitrary command execution as the user or Agent running the Skill. The attacker can read or alter any files accessible to that account, steal locally accessible credentials or authenticated CLI state, modify Agent memory and configuration, launch networ ...[truncated 259 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never pass generated configuration data to `source`, `eval`, or another shell interpreter. - Extract only explicitly supported fields using separate `jq -r` calls. - Validate `sync_human`, `sync_agent`, and `sync_backup` against the exact values `true` and `false`. - Restrict remote folder names to a conservative character allowlist and reject newlines, control characters, command substitutions, and shell metacharacters. - Assign extracted values as data using quoted Bash assignments, for example: ```bash SYNC_HUMAN=$(jq -r '.sync_human // false' "$CONFIG_FILE") OUTPUT_FOLDER=$(jq -r '.output_folder // "AI_Workspace"' "$CONFIG_FILE") ``` - Reject unknown JSON keys so configuration typos or malicious additions cannot influence runtime behavior. - Verify that the configuration file is a regular file owned by the expected user and is not writable by untrusted users. - Add regression tests containing values such as `$(id)`, backticks, semicolons, newlines, and malformed keys, and verify that none are interpreted by the shell. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/sync.sh:33
• Finding: Unpinned third-party CLI installation recommendation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/sync.sh:33-37` **Vulnerability Type**: Unsafe dependency acquisition **Risk Level**: Medium ### Vulnerable Code ```bash # Check if gog is available if ! command -v gog &>/dev/null; then echo "ℹ️ gog CLI not found. Sync skipped." echo " To enable: go install github.com/cilaboratory/gog@latest" echo " Then run: gog auth login" exit 0 fi ``` ### Technical Analysis The installation guidance recommends `@latest`, a mutable reference to the current upstream package version. It does not pin an audited release or commit and provides no checksum, signature, provenance, or integrity-verification instructions. The effective dependency contents can therefore change after the Skill has been reviewed. A compromised upstream repository, maintainer account, release process, or dependency chain could cause users following the recommendation to build and install attacker-controlled code. The Skill does not automatically execute this installation command, which limits immediate exploitability, but it presents the command as the supported enablement procedure. ### Attack Path 1. An attacker compromises the upstream package, its maintainer account, or a transitive dependency used by the current release. 2. The mutable `latest` version begins resolving to compromised source. 3. A user follows the installation instruction emitted by `sync.sh`. 4. Go downloads and builds the compromised package. 5. The resulting executable runs with the installing user's authority when invoked for authentication or synchronization. ### Impact Assessment A compromised dependency could execute with the privileges of the user installing or running it. Depending on the payload, this may expose local files, workspace content, Google authentication material, and other credentials accessible to the account. The scope is supply-chain dependent and requires the user to follow the displayed installation command; no di ...[truncated 71 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the CLI to a specific reviewed semantic version or immutable commit instead of `@latest`. - Publish the expected version and cryptographic checksum in the Skill documentation. - Prefer signed releases and document signature or provenance verification. - Review the pinned package and its dependency graph before updating. - Use an explicit upgrade process so dependency changes receive the same security review as Skill code changes. - Avoid automatically suggesting installation from a live development branch or mutable tag. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/organize.sh:44
• Finding: File organization and archiving can overwrite existing destination files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/organize.sh:44-73`; related archive operation in `scripts/archive.sh:57-62` **Vulnerability Type**: Unsafe file move and destination collision handling **Risk Level**: Medium ### Vulnerable Code ```bash # Images from artifacts -> Workspace_Human/output/images find "$ARTIFACTS" -maxdepth 1 -type f \( -name "*.png" -o -name "*.jpg" -o -name "*.jpeg" -o -name "*.gif" -o -name "*.webp" \) 2>/dev/null | while read -r file; do mv "$file" "$HUMAN/output/images/" echo " 📷 $(basename "$file") -> output/images/" MOVED=$((MOVED + 1)) done # Docs from artifacts -> Workspace_Human/output/docs find "$ARTIFACTS" -maxdepth 1 -type f \( -name "*.pdf" -o -name "*.docx" -o -name "*.doc" \) 2>/dev/null | while read -r file; do mv "$file" "$HUMAN/output/docs/" echo " 📄 $(basename "$file") -> output/docs/" MOVED=$((MOVED + 1)) done # Data files from artifacts -> Workspace_Human/output/data find "$ARTIFACTS" -maxdepth 1 -type f \( -name "*.json" -o -name "*.csv" -o -name "*.xml" \) 2>/dev/null | while read -r file; do mv "$file" "$HUMAN/output/data/" echo " 📊 $(basename "$file") -> output/data/" MOVED=$((MOVED + 1)) done # Temp files -> Workspace_Human/temp find "$ARTIFACTS" -maxdepth 1 -type f \( -name "*screenshot*" -o -name "cdp_tmp_*" -o -name "*.tmp" \) 2>/dev/null | while read -r file; do mv "$file" "$HUMAN/temp/" echo " 🕐 $(basename "$file") -> temp/" MOVED=$((MOVED + 1)) done # Files in workspace root -> artifacts find "$WORKSPACE" -maxdepth 1 -type f \( -name "*.png" -o -name "*.jpg" -o -name "*.pdf" -o -name "*.json" -o -name "*.csv" \) 2>/dev/null | grep -v -E "^(MEMORY|SOUL|USER|AGENTS|HEARTBEAT|TOOLS)" | while read -r file; do mv "$file" "$ARTIFACTS/" echo " 📦 $(basename "$file") -> artifacts/" MOVED=$((MOVED + 1)) done ``` The archive stage has the same collision behavior: ```bash # Archive files ARCHIVED=0 while IFS= read -r ...[truncated 1836 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Check the complete destination path before every move. - Use no-clobber behavior where supported, such as `mv -n`, and verify whether the move succeeded. - Prefer deterministic collision-safe names, such as appending a timestamp, sequence number, or content hash. - Report all collisions before mutation and require explicit user confirmation when replacement is requested. - If overwrite functionality is retained, first move the existing destination to system trash or a versioned backup. - Use `find -print0` with null-delimited reads to robustly process unusual filenames. - Add tests covering duplicate basenames across artifacts, human output directories, the workspace root, and monthly archive directories. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill advertises workspace management, but also documents uploading `Workspace_Human`, optionally `Workspace_Agent`, and core configuration/memory files to Google Drive. Because these locations can contain sensitive documents, agent memory, prompts, and credentials-related context, the undeclared external transfer capability materially expands the threat model and creates confidentiality risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill advertises workspace management, but also documents uploading `Workspace_Human`, optionally `Workspace_Agent`, and core configuration/memory files to Google Drive. Because these locations can contain sensitive documents, agent memory, prompts, and credentials-related context, the undeclared external transfer capability materially expands the threat model and creates confidentiality risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill advertises workspace management, but also documents uploading `Workspace_Human`, optionally `Workspace_Agent`, and core configuration/memory files to Google Drive. Because these locations can contain sensitive documents, agent memory, prompts, and credentials-related context, the undeclared external transfer capability materially expands the threat model and creates confidentiality risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill advertises workspace management, but also documents uploading `Workspace_Human`, optionally `Workspace_Agent`, and core configuration/memory files to Google Drive. Because these locations can contain sensitive documents, agent memory, prompts, and credentials-related context, the undeclared external transfer capability materially expands the threat model and creates confidentiality risk.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill is described as a local workspace-management tool, but this script adds Google Drive synchronization and backup of workspace data. That scope expansion is security-relevant because it introduces external data exfiltration capability users would not reasonably expect from a folder-organization skill.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script uploads Workspace_Human contents, optionally Workspace_Agent contents, and core files like MEMORY.md and IDENTITY.md to Google Drive. These files may contain sensitive user data, agent state, identity, or secrets, so remote transfer creates a meaningful confidentiality risk, especially because SYNC_HUMAN and SYNC_BACKUP default to true.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents direct shell execution of multiple scripts (`bash` and `python3`) but declares no explicit tool scope or permission boundary. In an agent environment, missing tool restrictions increases the chance of unintended command execution or privilege overreach, especially because the skill performs filesystem mutations and can invoke synchronization tooling.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger description is broad enough that ordinary phrases about a messy workspace could activate a skill that reorganizes files, trashes content, and may invoke optional sync behavior. Over-broad invocation criteria raise the chance of accidental execution of powerful operations without the user intending such changes.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: A skill positioned as local workspace management includes documented synchronization to Google Drive, which changes it from local maintenance into external data transfer. That increases risk substantially because users may invoke it expecting only local file operations while the skill can copy broad workspace contents off-host.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The optional sync step is not necessary for basic workspace structure maintenance and broadens the skill’s privileges to external network access and remote copying. Unnecessary capability expansion violates least privilege and creates avoidable exposure of local content to third-party storage.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The documentation explicitly states that all human workspace contents, optionally all agent workspace contents, and core memory/config files may be copied to cloud storage. In this skill context, that is particularly dangerous because those paths can contain personal files, prompts, logs, shared context, and persistent memory, creating a broad exfiltration surface if the step is run unintentionally or under weak review.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

path = Path(path_str)
        try:
            # Try trash-put first
            result = subprocess.run(["trash-put", str(path)], capture_output=True)
            if result.returncode == 0:
                success += 1
                print(f"🗑️  Trashed: {path.name}")

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script advertises local workspace maintenance but exposes a cloud backup/sync capability to Google Drive, creating a data-flow path outside the local machine that is not clearly aligned with the stated purpose. This increases the risk of unintended exfiltration of workspace contents, especially if users invoke the default full pipeline without appreciating that remote transfer is included.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: When no steps are provided, the script defaults to running all stages, including cleanup, archive, and sync, which can modify, move, delete, or export user data. Executing impactful actions by default without an explicit warning or confirmation makes accidental destructive changes and unintended remote transfer significantly more likely.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The pipeline directly invokes an external cloud sync step even though the skill is framed as workspace organization and maintenance. Any externally connected operation expands the trust boundary and can transmit sensitive files, metadata, or directory structure to third-party storage without strong justification or informed consent.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The comments present this as part of a workspace-manager skill, which lowers user suspicion, while the implementation performs remote cloud backup. That mismatch increases the chance of informed-consent failure: users may invoke the skill for local housekeeping without realizing it can transmit data externally.

Intent-Code Divergence

Low

• Confidence: 75% confidence
• Finding: The design-pattern section frames the skill as safely wrapping filesystem operations, which implies local workspace management. Later documentation introduces Google Drive synchronization of broad workspace content, contradicting that narrow characterization by adding an external data-transfer behavior.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The manifest describes workspace structure management, cleanup, classification, and health auditing. While auditing justifies scanning for broken links and size statistics, listing recently modified files exposes specific activity details that are not clearly necessary for a structural health check and broadens the skill into activity inspection.

Intent-Code Divergence

Low

• Confidence: 76% confidence
• Finding: The script's comments and behavior present it as a health check, but the final recommendation directs users to run an external cleanup command. In this file, no cleanup is performed, so the guidance extends beyond the implemented behavior and may mislead users about what this component itself does.

Static analysis

No suspicious patterns detected.