Heleni Best Practices

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:51 AM UTC
• Version: 1.0.2

Overview

The skill is disclosed as a best-practices sync tool, but it gives a recurring workflow permission to ingest third-party content and make some persistent agent-behavior changes without explicit approval.

Install only if you are comfortable with a daily networked sync that can write local state and learning logs and may update skill metadata. Before enabling it, require explicit approval for every persistent write, disable silent cron behavior, pin or review upstream content, and replace fixed /tmp paths with private temporary files.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:91

Finding

Untrusted Remote Content Can Poison Persistent Agent Configuration

Content

View full analysis

Remediation

View remediation

T06 · System Persistence

Warning

• Location: SKILL.md:149

Finding

Scheduled Synchronization Creates a Recurring External Instruction Channel

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:36

Finding

Predictable Shared Temporary Files Permit Symlink and Content-Replacement Attacks

Content

View full analysis

/tmp/heleni-skills-current.txt ``` ### Technical Analysis The workflow uses fixed, globally predictable paths under `/tmp`. In a multi-user or otherwise adversarial local environment, another process may create these paths before the skill runs, replace them between workflow stages, or create symbolic links that redirect writes. The downloaded HTML and generated skill list are later read to calculate hashes and update persistent state. Therefore, local manipulation of the temporary files can affect both change detection and the content the agent considers current. The exact consequences of a symlink attack depend on the operating system's protections and the privileges of the account running the skill. The code does not create a private temporary directory, verify file ownership or type, prevent symlink following, or clean up securely. The flagged `curl | bash` pattern is not present in this file. The first `curl` writes HTML to a file, and the second pipes GitHub API JSON into a local Python JSON parser; neither command directly executes downloaded shell code. ### Attack Path 1. A local attacker predicts `/tmp/heleni-learn-current.html` or `/tmp/heleni-skills-current.txt`. 2. Before execution, the attacker creates a symbolic link at one of those pat ...[truncated 1121 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description frames behavior as fetching updates and applying lessons, but the body authorizes local modifications to agent configuration files and logs. This mismatch can cause the agent or owner to underestimate the scope of side effects, leading to unintended persistence or policy drift from externally sourced content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill says it 'applies relevant lessons to this agent's own SOUL.md / AGENTS.md / HOT.md,' but later says SOUL.md and HOT.md changes always require approval. This inconsistency creates unsafe ambiguity in execution, making it more likely an agent will modify sensitive governance files based on remote content without proper consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 72% confidence

Finding

The skill performs network access to external domains to retrieve content that is later used to recommend or drive local configuration changes. While outbound fetches are core to the skill's purpose, the danger comes from trusting externally hosted material as an input to governance and skill-management decisions.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

curl -s "$LEARN_URL" -o /tmp/heleni-learn-current.html

Get list of active skills from GitHub

curl -s "https://api.github.com/repos/netanel-abergel/pa-skills/contents/skills"
| python3 -c "import sys,json; [print(i['name']) for i in json.load(sys.stdin) if i['type']=='dir']" \

/tmp/heleni-skills-current.txt

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill writes a persistent state file on first run and on subsequent updates without an explicit warning at invocation time. This creates unannounced local state that can affect future behavior and makes the skill more dangerous because remote content is being used to drive ongoing autonomous decisions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The skill explicitly permits autonomous actions such as logging lessons and updating skill descriptions without asking the owner. Autonomous modification of local artifacts based on remote content expands the blast radius of bad parsing, poisoned upstream content, or accidental activation.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

- Adding to HOT.md (owner should approve)
- Installing a new skill

**Can apply without asking:**
- Logging the lesson to `.learnings/heleni-sync/YYYY-MM-DD.md`
- Updating skill descriptions in skill-master

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill allows silent logging to .learnings/heleni-sync/YYYY-MM-DD.md without clearly surfacing that persistent local data will be created. Hidden persistence is risky because it can accumulate externally derived content, metadata, or operational history without informed approval or retention controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrase 'sync skills' is broad and can plausibly match unrelated maintenance requests. Overbroad activation increases the chance this networked, state-writing skill runs unexpectedly and performs external fetches or local writes outside the user's intended task.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 15% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

RAW_BASE="https://raw.githubusercontent.com/netanel-abergel/pa-skills/main/skills"

# Fetch learn page
curl -s "$LEARN_URL" -o /tmp/heleni-learn-current.html

# Get list of active skills from GitHub
curl -s "https://api.github.com/repos/netanel-abergel/pa-skills/contents/skills" \

Static analysis

No suspicious patterns detected.