Agent Comm Monitor

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:38 PM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it can inspect other agents' session history and write persistent logs without clear limits or user approval.

Review before installing. This skill is suitable only if you are comfortable granting it access to named agents' communication state, and it should ideally be revised to avoid broad session-history reads and to ask before writing MEMORY.md or HEARTBEAT.md.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:33

Finding

Overbroad Access to Other Agents' Session Histories

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33-35
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code Snippet:

markdown

### 3. 备用验证

如果 `sessions_send` 返回超时，使用 `sessions_history` 检查目标 Agent 的会话历史，确认消息是否已送达。

English translation: If sessions_send times out, use sessions_history to inspect the target Agent's session history and confirm whether the message was delivered.

Technical Analysis

The Skill instructs the monitoring Agent to read another Agent's session history whenever a communication test times out. This exceeds the minimum permissions needed to determine message-delivery status. Session histories can contain unrelated user conversations, task data, credentials, or other sensitive context.

The instruction does not require explicit user consent, restrict the query to messages generated during the current test, require a unique test identifier, or prohibit the monitoring Agent from processing or disclosing unrelated records. A delivery-status API or narrowly scoped acknowledgment mechanism would satisfy the stated purpose without exposing historical conversation content.

Attack Path

1. A user invokes the Agent communication-monitoring Skill.
2. The Skill sends a test message to a predefined target Agent through sessions_send.
3. The request times out, whether because of an actual delay, an unavailable Agent, or intentionally induced nonresponse.
4. The timeout activates the documented fallback to sessions_history.
5. The monitoring Agent gains access to the target Agent's session records.
6. Unrelated sensitive records may enter the monitoring Agent's context and could subsequently influence its behavior, appear in a report, or be persisted in diagnostic records.

Impact Assessment

Successful exploitation can expose cross-Agent conversation data beyond the communication test's legitimate scope. The ...[truncated 462 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the sessions_history fallback and use a dedicated delivery-receipt or message-status API that returns only delivery metadata.
2. If session-history access is unavoidable, require explicit user authorization before accessing another Agent's records.
3. Generate a unique random identifier for each test and retrieve only messages matching that identifier.
4. Restrict queries to the target session and a narrow time window beginning at the test timestamp.
5. Process only sender, timestamp, delivery status, and matching acknowledgment metadata; do not retrieve or report unrelated message bodies.
6. Enforce access controls so the monitoring Agent cannot inspect sessions outside an approved allowlist.
7. Ensure reports, MEMORY.md, and HEARTBEAT.md contain only Agent identifiers, timestamps, response times, and status codes—not conversation content.
8. Add audit logging for every cross-Agent history query, including the requesting identity, authorization basis, target session, time range, and fields accessed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to write abnormal communication results to MEMORY.md and HEARTBEAT.md without requiring explicit user consent or warning that persistent files will be modified. This creates an unauthorized state-changing side effect: sensitive operational details may be persisted, and the agent could alter project files during what appears to be a read-only status check.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language content instructs the agent in Chinese and specifies a fixed reporting format in Chinese, but does not indicate that the user can choose another language. Under the language/locale policy, forcing a specific language without opt-in can be a policy violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.