Back to skill

Security audit

workspace-manager

Security checks for vulnerabilities and agentic risk

Overview

This workspace-management skill needs review because its full pipeline can move local files and upload broad workspace contents, including memory/config files, to Google Drive despite a claimed dry-run mode.

Install only after reviewing the scripts and only if you intentionally want this skill to reorganize workspace files and potentially sync data to Google Drive. Do not rely on --dry-run as non-mutating in this version; disable sync_human and sync_backup, remove or unauthenticate gog, or avoid --all until the dry-run, sync opt-in, config parsing, and overwrite-collision issues are fixed.

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/pipeline.sh:90
Finding

Dry-run mode performs local mutations and cloud uploads

Content
View full analysis
&1 | tee -a "$STEP_LOG"; then pass "Organize complete" else warn "Organize completed with warnings" fi ;; ``` ```bash sync) log "☁️ Step 5/5: Running cloud sync (optional)..." # Sync is optional - don't count as failure if skipped if bash "$SCRIPT_DIR/sync.sh" 2>&1 | tee -a "$STEP_LOG"; then pass "Sync complete" else SYNC_EXIT=${PIPESTATUS[0]} if [ $SYNC_EXIT -eq 0 ]; then pass "Sync skipped (gog not configured)" else warn "Sync completed with warnings" fi fi ;; ``` The default synchronization configuration enables human workspace and core-file uploads: ```json { "sync_human": true, "sync_agent": false, "sync_backup": true, "output_folder": "AI_Workspace", "backup_folder": "AI_Workspace_Backup", "_comment": "Set sync_human/sync_agent to true to enable, false to skip. Requires gog CLI installed and authenticated." } ``` The corresponding upload operations are: ```bash if [ "$SYNC_HUMAN" = "true" ] && [ -d "$HUMAN" ]; then echo "📁 Syncing Workspace_Human/..." echo " → $OUTPUT_FOLDER/Workspace_Human/" FILE_COUNT=$(find "$HUMAN" -type f 2>/dev/null | wc -l || echo 0) echo " Files: $FILE_COUNT" if [ "$FILE_COUNT" -eq 0 ]; then echo " ℹ️ Nothing to sync" elif gog drive sync upload "$HUMAN/" ...[truncated 2382 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/sync.sh:14
Finding

Arbitrary shell command execution through sourced JSON configuration

Content
View full analysis
/dev/null || true) fi ``` ### Technical Analysis The script transforms every JSON key and value into shell assignment text and then executes that text with Bash `source`. Neither keys nor values are shell-escaped, and there is no allowlist restricting accepted configuration fields. A value containing command substitution or other shell syntax becomes executable shell code. For example, an attacker-controlled value such as `"$(id > /tmp/proof)"` can be rendered as an assignment whose command substitution is evaluated when the generated stream is sourced. Malicious keys can likewise alter the generated shell grammar. This is not merely unsafe parsing: `source` treats configuration data as executable code. ### Attack Path 1. An attacker, compromised update, or lower-trust process obtains write access to `config/sync-config.json`. 2. The attacker inserts shell syntax into a key or value, for example a command substitution in `output_folder`. 3. A user or Agent runs `scripts/sync.sh`, directly or through the default pipeline. 4. `jq` converts the malicious JSON entry into unquoted shell source text. 5. Bash `source` parses the generated text and executes the injected command. 6. The payload runs with all filesystem, process, credential, and network permissions held by the invoking user. ### Impact Assessment Successful exploitation provides arbitrary command execution as the user or Agent running the Skill. The attacker can read or alter any files accessible to that account, steal locally accessible credentials or authenticated CLI state, modify Agent memory and configuration, launch networ ...[truncated 259 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/sync.sh:33
Finding

Unpinned third-party CLI installation recommendation

Content
View full analysis
/dev/null; then echo "ℹ️ gog CLI not found. Sync skipped." echo " To enable: go install github.com/cilaboratory/gog@latest" echo " Then run: gog auth login" exit 0 fi ``` ### Technical Analysis The installation guidance recommends `@latest`, a mutable reference to the current upstream package version. It does not pin an audited release or commit and provides no checksum, signature, provenance, or integrity-verification instructions. The effective dependency contents can therefore change after the Skill has been reviewed. A compromised upstream repository, maintainer account, release process, or dependency chain could cause users following the recommendation to build and install attacker-controlled code. The Skill does not automatically execute this installation command, which limits immediate exploitability, but it presents the command as the supported enablement procedure. ### Attack Path 1. An attacker compromises the upstream package, its maintainer account, or a transitive dependency used by the current release. 2. The mutable `latest` version begins resolving to compromised source. 3. A user follows the installation instruction emitted by `sync.sh`. 4. Go downloads and builds the compromised package. 5. The resulting executable runs with the installing user's authority when invoked for authentication or synchronization. ### Impact Assessment A compromised dependency could execute with the privileges of the user installing or running it. Depending on the payload, this may expose local files, workspace content, Google authentication material, and other credentials accessible to the account. The scope is supply-chain dependent and requires the user to follow the displayed installation command; no di ...[truncated 71 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/organize.sh:44
Finding

File organization and archiving can overwrite existing destination files

Content
View full analysis
Workspace_Human/output/images find "$ARTIFACTS" -maxdepth 1 -type f \( -name "*.png" -o -name "*.jpg" -o -name "*.jpeg" -o -name "*.gif" -o -name "*.webp" \) 2>/dev/null | while read -r file; do mv "$file" "$HUMAN/output/images/" echo " 📷 $(basename "$file") -> output/images/" MOVED=$((MOVED + 1)) done # Docs from artifacts -> Workspace_Human/output/docs find "$ARTIFACTS" -maxdepth 1 -type f \( -name "*.pdf" -o -name "*.docx" -o -name "*.doc" \) 2>/dev/null | while read -r file; do mv "$file" "$HUMAN/output/docs/" echo " 📄 $(basename "$file") -> output/docs/" MOVED=$((MOVED + 1)) done # Data files from artifacts -> Workspace_Human/output/data find "$ARTIFACTS" -maxdepth 1 -type f \( -name "*.json" -o -name "*.csv" -o -name "*.xml" \) 2>/dev/null | while read -r file; do mv "$file" "$HUMAN/output/data/" echo " 📊 $(basename "$file") -> output/data/" MOVED=$((MOVED + 1)) done # Temp files -> Workspace_Human/temp find "$ARTIFACTS" -maxdepth 1 -type f \( -name "*screenshot*" -o -name "cdp_tmp_*" -o -name "*.tmp" \) 2>/dev/null | while read -r file; do mv "$file" "$HUMAN/temp/" echo " 🕐 $(basename "$file") -> temp/" MOVED=$((MOVED + 1)) done # Files in workspace root -> artifacts find "$WORKSPACE" -maxdepth 1 -type f \( -name "*.png" -o -name "*.jpg" -o -name "*.pdf" -o -name "*.json" -o -name "*.csv" \) 2>/dev/null | grep -v -E "^(MEMORY|SOUL|USER|AGENTS|HEARTBEAT|TOOLS)" | while read -r file; do mv "$file" "$ARTIFACTS/" echo " 📦 $(basename "$file") -> artifacts/" MOVED=$((MOVED + 1)) done ``` The archive stage has the same collision behavior: ```bash # Archive files ARCHIVED=0 while IFS= read -r ...[truncated 1836 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill advertises workspace management, but also documents uploading Workspace_Human, optionally Workspace_Agent, and core configuration/memory files to Google Drive. Because these locations can contain sensitive documents, agent memory, prompts, and credentials-related context, the undeclared external transfer capability materially expands the threat model and creates confidentiality risk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill advertises workspace management, but also documents uploading Workspace_Human, optionally Workspace_Agent, and core configuration/memory files to Google Drive. Because these locations can contain sensitive documents, agent memory, prompts, and credentials-related context, the undeclared external transfer capability materially expands the threat model and creates confidentiality risk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill advertises workspace management, but also documents uploading Workspace_Human, optionally Workspace_Agent, and core configuration/memory files to Google Drive. Because these locations can contain sensitive documents, agent memory, prompts, and credentials-related context, the undeclared external transfer capability materially expands the threat model and creates confidentiality risk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill advertises workspace management, but also documents uploading Workspace_Human, optionally Workspace_Agent, and core configuration/memory files to Google Drive. Because these locations can contain sensitive documents, agent memory, prompts, and credentials-related context, the undeclared external transfer capability materially expands the threat model and creates confidentiality risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is described as a local workspace-management tool, but this script adds Google Drive synchronization and backup of workspace data. That scope expansion is security-relevant because it introduces external data exfiltration capability users would not reasonably expect from a folder-organization skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script uploads Workspace_Human contents, optionally Workspace_Agent contents, and core files like MEMORY.md and IDENTITY.md to Google Drive. These files may contain sensitive user data, agent state, identity, or secrets, so remote transfer creates a meaningful confidentiality risk, especially because SYNC_HUMAN and SYNC_BACKUP default to true.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill documents direct shell execution of multiple scripts (bash and python3) but declares no explicit tool scope or permission boundary. In an agent environment, missing tool restrictions increases the chance of unintended command execution or privilege overreach, especially because the skill performs filesystem mutations and can invoke synchronization tooling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger description is broad enough that ordinary phrases about a messy workspace could activate a skill that reorganizes files, trashes content, and may invoke optional sync behavior. Over-broad invocation criteria raise the chance of accidental execution of powerful operations without the user intending such changes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

A skill positioned as local workspace management includes documented synchronization to Google Drive, which changes it from local maintenance into external data transfer. That increases risk substantially because users may invoke it expecting only local file operations while the skill can copy broad workspace contents off-host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The optional sync step is not necessary for basic workspace structure maintenance and broadens the skill’s privileges to external network access and remote copying. Unnecessary capability expansion violates least privilege and creates avoidable exposure of local content to third-party storage.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation explicitly states that all human workspace contents, optionally all agent workspace contents, and core memory/config files may be copied to cloud storage. In this skill context, that is particularly dangerous because those paths can contain personal files, prompts, logs, shared context, and persistent memory, creating a broad exfiltration surface if the step is run unintentionally or under weak review.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/cleanup.py (reported line 135)May include surrounding context.

python
path = Path(path_str)
        try:
            # Try trash-put first
            result = subprocess.run(["trash-put", str(path)], capture_output=True)
            if result.returncode == 0:
                success += 1
                print(f"🗑️  Trashed: {path.name}")

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script advertises local workspace maintenance but exposes a cloud backup/sync capability to Google Drive, creating a data-flow path outside the local machine that is not clearly aligned with the stated purpose. This increases the risk of unintended exfiltration of workspace contents, especially if users invoke the default full pipeline without appreciating that remote transfer is included.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

When no steps are provided, the script defaults to running all stages, including cleanup, archive, and sync, which can modify, move, delete, or export user data. Executing impactful actions by default without an explicit warning or confirmation makes accidental destructive changes and unintended remote transfer significantly more likely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The pipeline directly invokes an external cloud sync step even though the skill is framed as workspace organization and maintenance. Any externally connected operation expands the trust boundary and can transmit sensitive files, metadata, or directory structure to third-party storage without strong justification or informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The comments present this as part of a workspace-manager skill, which lowers user suspicion, while the implementation performs remote cloud backup. That mismatch increases the chance of informed-consent failure: users may invoke the skill for local housekeeping without realizing it can transmit data externally.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The design-pattern section frames the skill as safely wrapping filesystem operations, which implies local workspace management. Later documentation introduces Google Drive synchronization of broad workspace content, contradicting that narrow characterization by adding an external data-transfer behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest describes workspace structure management, cleanup, classification, and health auditing. While auditing justifies scanning for broken links and size statistics, listing recently modified files exposes specific activity details that are not clearly necessary for a structural health check and broadens the skill into activity inspection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The script's comments and behavior present it as a health check, but the final recommendation directs users to run an external cleanup command. In this file, no cleanup is performed, so the guidance extends beyond the implemented behavior and may mislead users about what this component itself does.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.