T01 · Skill Instruction Hijacking
Error
- Location
tools/skill_writer.py:28- Finding
Persistent instruction hijacking through globally installed generated Skills
- Content
View full analysis
- Remediation
View remediation
Security audit
teammate.skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly coherent, but it collects and persists sensitive coworker data and generated agent instructions with insufficient scoping and consent controls.
Install only if you have authorization and the teammate's consent to use their communications and work artifacts. Prefer manual, approved source files; avoid private-channel Slack scopes unless explicitly approved; use fine-grained read-only GitHub tokens; secure or avoid persisted tokens; review generated SKILL.md files before global installation; do not share raw knowledge files or generated personas without a privacy review.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
tools/slack_collector.py:36- Finding
Slack Bot OAuth token is stored in plaintext without enforced file permissions
- Content
View full analysis
dict: """Load Slack config.""" if not CONFIG_PATH.exists(): print("❌ No Slack config found. Run with --setup first.") sys.exit(1) return json.loads(CONFIG_PATH.read_text(encoding="utf-8")) ``` ### Technical Analysis The Bot OAuth token is persistently stored in `~/.teammate-skill/slack_config.json` as plaintext JSON. Neither the configuration directory nor the token file is assigned an explicit restrictive mode such as `0700` and `0600`. Consequently, confidentiality depends on the user's process umask and host configuration. The token is especially sensitive because the documented scopes include channel history and private-channel history. ### Attack Path 1. A user runs `slack_collector.py --setup` and enters a valid Bot OAuth token. 2. The script writes the token as plaintext to the user's home directory. 3. A local process, another account on a permissively configured system, an exposed backup, or malware reads the configuration file. 4. The attacker uses the recovered token against Slack's API. 5. The attacker accesses every workspace resource granted to that bot until the token is revoked. ### Impact Assessment The recovered token can grant access to user directory data, public-channel history, and private-channel history for channels accessible to the bot. The exact scope depends on Slack configuration and channel membership, but may ...[truncated 75 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
tools/slack_collector.py:100- Finding
Slack collector requests and scans private channels beyond minimum necessary scope
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
tools/skill_writer.py:83- Finding
Unvalidated teammate slug allows filesystem path traversal and arbitrary file placement
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unbounded Slack SDK dependency permits unreproducible and unsafe future package resolution
- Content
View full analysis
=3.0 ``` Installation guidance executes ordinary dependency resolution: ```bash pip3 install -r requirements.txt ``` ### Technical Analysis The dependency declaration accepts every future `slack_sdk` release with a version greater than or equal to 3.0. It does not include an upper bound, exact reviewed version, lock file, or package hash. This produces non-reproducible installations. A future compromised, malicious, or unexpectedly incompatible package release could be installed without any project change. This dependency is security-sensitive because it runs in the same process that loads the plaintext Slack token and accesses workspace communications. No evidence showed that the currently named package is typosquatted or malicious; the risk arises from unconstrained future resolution. ### Attack Path 1. A user installs the project dependencies at a later time. 2. The package index resolves `slack_sdk` to a new release allowed by `>=3.0`. 3. The release contains malicious or vulnerable behavior, whether through upstream compromise or a defective update. 4. Its code runs when imported by `slack_collector.py`. 5. The dependency can access the process environment, local files, Slack token, and collected message data under the current user's privileges. ### Impact Assessment A compromised dependency would execute with the privileges of the Agent or user running the collector. It could read the Slack token, access collected messages, modify local files, or make network requests. The exact impact depends on the runtime account's filesystem and network permissions. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (90)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The guide instructs creation of a GitHub personal access token with potentially broad repository access but does not emphasize least privilege, secure storage, rotation, or the consequences of compromise. In a skill that automates extraction of engineering knowledge from private repos, a mishandled PAT could enable unauthorized access to source code and associated metadata across private projects.
- Content
md Pulls PRs, code reviews, commit messages, and issue comments. **Step 1: Create a Personal Access Token** 1. Go to [github.com/settings/tokens](https://github.com/settings/tokens) → **Generate new token (classic)** 2. Select scope: `repo` (private repos) or `public_repo` (public only)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a system for distilling a teammate into an AI skill by collecting data from communication and code platforms and generating structured outputs like a Work Skill and 5-layer Persona. The supplied code does none of that. It only parses Confluence HTML/ZIP exports into plain text and saves them to a file, with optional filtering by a target name. This is a materially different primary purpose and accesses a different resource type than described, so it is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This is a clear mismatch. The declared description promises a knowledge-capture/AI-teammate creation capability based on workplace platforms like Slack, Teams, and GitHub, including persona generation and continuous evolution. The supplied code does none of that. It simply parses local email files, filters by sender, extracts message text, and saves results to a text file. Its primary purpose, inputs, outputs, and accessed resources are materially different from the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description focuses on knowledge capture and AI teammate creation from external collaboration sources like Slack, Teams, and GitHub, including persona/work-skill generation and continuous evolution. The actual code does none of that. It does not collect data from external services, generate a skill or persona, or evolve anything. Instead, it packages already-existing teammate files for portability and can also import such packages. This is a materially different primary purpose and introduces undeclared file packaging/import capabilities, so this should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description promises a broader teammate-distillation workflow: multi-source collection (Slack, Teams, GitHub) plus synthesis into an AI skill/persona that evolves over time. The actual code only performs one narrow subtask: collecting GitHub PRs, review comments, and issue comments for a username and saving them to files. While GitHub collection is consistent with one part of the declared description, the primary purpose of the code chunk is data harvesting/export, not distilling a teammate into an AI skill. The major advertised outputs and behaviors are absent, so this is a material description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a teammate-distillation skill focused on aggregating collaboration-platform data and generating an AI teammate artifact. The supplied code does something materially different: it only parses local Notion export files and writes extracted document text to an output file. While Notion content extraction could conceivably be a supporting subcomponent of a broader teammate-distillation pipeline, this chunk by itself lacks the described primary behavior, data sources, and outputs. Therefore this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose focuses on teammate knowledge capture and AI skill/persona generation from collaboration platforms like Slack, Teams, and GitHub. The actual code does none of that: it does not connect to external services, collect teammate data, generate skills/personas, or implement continuous evolution. Instead, it scans local files for sensitive data such as emails, phone numbers, API tokens, private keys, and passwords, and can redact them. This is a materially different primary purpose and introduces undeclared capabilities related to privacy/security scanning and file modification.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description centers on creating an AI version of a teammate from workplace knowledge sources like Slack, Teams, and GitHub. The supplied code does something materially different: it parses exported issue tracker data from JIRA or Linear for a named user and writes issue summaries to a text file. There is no functionality for collecting Slack/Teams/GitHub data, synthesizing a work skill or 5-layer persona, or continuously evolving a teammate model. This is a clear purpose and capability mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The description presents this skill as an end-to-end teammate distillation system that gathers data from Slack/Teams/GitHub and generates an AI teammate profile with ongoing evolution. The supplied code does not perform any data collection, analysis, synthesis, or model/persona generation. Instead, it is a utility that writes provided meta/work/persona content into a directory structure, regenerates a templated SKILL.md, updates versions and timestamps, applies simple text patches, and lists existing skills. While 'continuous evolution' is loosely related to the update/versioning behavior, the core declared capabilities are absent, and the actual code's primary purpose is file writing and bookkeeping.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description claims a broader teammate-distillation system that auto-collects from Slack, Teams, and GitHub and then generates higher-level AI-skill/persona artifacts. This code chunk only implements one part of that story: Slack data collection. More importantly, it performs a significant capability not reflected in the declared permissions: accessing Slack workspace data using a bot token, including private/public channel history and user enumeration, then saving extracted content locally. Because the declared permissions are empty and the described functionality emphasizes teammate distillation outputs rather than direct Slack harvesting behavior, this is a meaningful description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The code’s actual function is narrow and preparatory: it parses Slack export data for a specified user and outputs formatted message history. While Slack data extraction could be one component of a teammate-distillation workflow, this chunk does not implement the core declared purpose. The declared description emphasizes creating an AI version of a teammate using multi-source data and persona/skill generation, but the code only handles Slack message extraction from an existing export. This is a material mismatch in primary purpose and implemented capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description promises a higher-level system for distilling a teammate into an AI Skill using Slack/Teams/GitHub data and producing structured outputs like a Work Skill and 5-layer Persona with continuous evolution. The supplied code does not do that. It only parses Teams JSON and Outlook email exports for a specified target and writes extracted message content to a text file. While parsing Teams/Outlook data could be a supporting component of the broader skill, this code chunk’s actual behavior is much narrower and lacks the core advertised functionality. Therefore the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description focuses on knowledge capture and AI teammate creation from external collaboration sources. The actual code does not implement any of that functionality. Instead, it manages local file-based versions for existing teammate skill artifacts (SKILL.md, work.md, persona.md, meta.json), including backup, listing versions, cleanup of old archives, and rollback. This is a materially different primary purpose and introduces an undeclared capability: version archiving/rollback. Therefore the description does not accurately represent this code chunk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description promises automatic collection of Slack/Teams/GitHub data but does not foreground that these are privacy-sensitive, potentially confidential sources. Users may invoke the skill without understanding it could access coworkers' communications, code review history, or workplace data, undermining informed consent.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The core workflow is to aggregate a colleague's communications and work artifacts, then transform them into a reusable persona/skill. This is dangerous because it enables large-scale profiling and impersonation using potentially private, employment-related, or confidential materials, with unclear consent and retention boundaries.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The source-import menu explicitly encourages collecting a person's messages, emails, notes, and pasted chat logs as raw inputs. In this context, the skill's purpose is to model a real coworker, which makes the data especially sensitive and heightens the risk of privacy violations, insider information leakage, and reputational harm.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The Slack auto-collect step directs retrieval of a target user's messages and threads into local files, effectively surveilling and retaining a coworker's communications for persona creation. This is highly sensitive workplace data and could expose confidential discussions, personal information, or privileged content at scale.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The skill defines deletion as
rm -rf teammates/{slug}using a user-influenced parameter. Without strict slug validation and safe path handling, a crafted value could cause path traversal or deletion of unintended directories, and the use of recursive force deletion makes the impact severe and immediate.- Content
md | `/compare {slug1} vs {slug2}` | Read `{baseDir}/prompts/compare.md`, then load both teammates' work.md + persona.md and generate side-by-side comparison | | `/export-teammate {slug}` | `python3 {baseDir}/tools/export.py --slug {slug} --base-dir ./teammates` — creates portable package | | `/teammate-rollback {slug} {ver}` | `python3 {baseDir}/tools/version_manager.py --action rollback --slug {slug} --version {ver} --base-dir ./teammates` | | `/delete-teammate {slug}` | Confirm, then `rm -rf teammates/{slug}` | ---
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list is broad enough to match ordinary conversational feedback like 'actually' or 'more like,' which can cause the correction workflow to activate when the user did not intend to edit persistent skill data. In this skill, unintended activation is especially risky because the handler is designed to convert natural language into durable persona/work rules, allowing accidental or adversarial steering of the generated teammate profile.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The prompt establishes a safety principle of 'Don't speculate,' then later overrides it by mandating inferred content when evidence is absent. This contradiction weakens the model’s reliability guardrails and can cause downstream consumers to treat fabricated details as sourced truth, especially because the output is intended for direct use in generating work.md.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
python json.dumps(meta, indent=2, ensure_ascii=False), encoding="utf-8" ) # Generate and write SKILL.md identity = build_identity(meta) skill_md = SKILL_MD_TEMPLATE.format( slug=slug,
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script is explicitly designed to collect a coworker’s Slack messages, thread replies, and activity across public and private channels, then store them locally, but it provides no consent flow, privacy notice, sensitivity filtering, or access-control safeguards. In the context of a skill meant to 'capture a colleague's knowledge before they leave' and create an AI version of them, this substantially raises the risk of unauthorized surveillance, bulk exfiltration of confidential business communications, and downstream misuse of personal or regulated data.
- Content
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
Collecting thread replies expands the capture from a target user’s visible messages into richer conversational context, including sensitive discussions in private channels and replies that may reveal confidential projects, credentials, legal matters, or personal information. Because the skill’s purpose is to distill a person into a reusable AI artifact, this contextual harvesting materially increases the chance of leaking privileged information into local files and later model inputs.
- Content
python "text": text, }) # Collect thread replies if this is a thread parent if msg.get("reply_count", 0) > 0: try: thread_response = client.conversations_replies(
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - **One-shot creation**: Provide name + role + personality in one message → skip 3-question intake - **Batch corrections**: Fix multiple persona issues in a single pass - **Auto-apply simple corrections**: No confirmation needed (only on conflicts or Layer 0 changes) - **Compact merger summaries**: Emoji + one-liner per file, auto-apply on zero conflicts - **Honest "profile-only" markers**: No fictional examples when source data is skipped - **Error Recovery**: Graceful script failures, off-script handling, interrupted creation resume
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash # Per-project (at your git repo root) mkdir -p .claude/skills git clone https://github.com/LeoYeAI/teammate-skill .claude/skills/create-teammate # Or global (all projects)
Static analysis
No suspicious patterns detected.