Security audit

Managed Agent Growth Loop

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it tells agents to create recurring customer-operations cron/heartbeat jobs without enough approval, expiry, or access-boundary safeguards.

Install only if you want this skill to help create operational memory and recurring follow-up loops. Before accepting any cron or heartbeat suggestion, require explicit approval, a named owner, a customer-specific data boundary, a verified delivery channel, and an expiration or review date. Omit branded service-value sections when you need neutral reports.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Warning

Location: SKILL.md:118
Finding: Persistent Agent Execution Through Recurring Cron and Heartbeat Jobs
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:193
Finding: Mandatory Commercial Branding in Agent-Generated Operational Reports
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description embeds broad trigger phrases such as '에이전트 운영 개선', '현장 회고', and '선제적 행동' that can match many ordinary conversations. This can cause the skill to activate in contexts where the user did not intend operational memory, cron, or monitoring behavior, increasing the chance of unnecessary autonomous planning or data handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The execution trigger section defines applicability using ambiguous situations like '작업은 많이 했는데 다음 단계...불명확' and onboarding/operations requests without boundaries. In this skill's context, that ambiguity is more dangerous because the skill recommends persistent state files, proactive watchlists, and cron/heartbeat promotion, so accidental invocation can expand monitoring or workflow automation beyond user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The cron examples hard-code the timezone to "Asia/Seoul", which imposes a locale-specific operational default in natural-language guidance. The file does not offer user choice or explain that the skill is intended only for a Korea-specific deployment context, so this can violate locale flexibility expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.