Security audit

pa-ownership

Security checks for vulnerabilities and agentic risk

Overview

This skill is a task tracker, but it gives broad automatic execution, retry, messaging, memory-writing, and heartbeat persistence authority without enough scoping or authorization.

Review carefully before installing. Only use this skill in an environment where task initiators are trusted, group-triggered tasks are gated, sensitive actions require confirmation, .context is not shell-sourced, and task content written to memory or outbound reports is minimized or redacted.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:15
Finding: Unvalidated Local Configuration File Is Executed as Shell Code
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:87
Finding: Tasks from Insufficiently Trusted Sources May Use All Available Agent Tools
Content: View full analysis
` 4. Determine `initiated_by`: - DM from Netanel → `"Netanel"` - Group message → `"group:"` - Heleni's own initiative → `"self"` 5. Set `status: "NEW"`, `attempts: 0` 6. Write updated JSON back to file 7. Write to WhatsApp memory: `memory/whatsapp/dms//context.md` ### Step 2: Execute 1. Set status to `IN_PROGRESS`, update `updated_at` 2. Execute the task using available tools ``` ### Technical Analysis The Skill accepts tasks originating from direct messages and group messages, then instructs the Agent to execute each task using “available tools.” It does not define: - Authentication requirements for task initiators. - Authorization rules for group participants. - A tool allowlist. - Per-source capability restrictions. - Confirmation requirements for sensitive operations. - Restrictions against destructive, privileged, or externally visible actions. Recording `initiated_by` identifies the apparent source but does not authorize that source. In particular, a group identifier does not establish that every participant in the group is trusted to initiate filesystem, network, messaging, or other tool actions. The broad instruction to use all available tools violates least privilege. It can convert a task-tracking trigger into an execution path for capabilities unrelated to task registration and status reporting. ### Attack Path 1. An untrusted or compromised participant sends a message containing a configured trigger phrase, such as “take ownership.” 2. The message requests an action requiring a sensitive Agent tool. 3. Th ...[truncated 1079 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:96
Finding: Untrusted Task Content Is Persisted into Long-Term Agent Memory
Content: View full analysis
/context.md` ``` The completion procedure also persists task outcomes: ```markdown 3. Update the JSON file 4. Write outcome to WhatsApp memory file ``` ### Technical Analysis Task descriptions originate from direct or group messages and may therefore contain attacker-controlled text. The Skill directs the Agent to write task context and outcomes into WhatsApp memory, but it does not prescribe: - A structured and non-executable storage format. - Content sanitization or escaping. - Provenance and trust labels. - Separation between untrusted message data and trusted Agent instructions. - A rule requiring future memory readers to treat stored content strictly as data. If later sessions load the memory file into an Agent context, instruction-like content can persist beyond the original conversation. An attacker can place imperative text, fabricated policy, or misleading state into a task so that it is copied into memory and potentially interpreted as a future instruction. The phone component is described as sanitized, which may mitigate path-manipulation concerns, but it does not address semantic poisoning of the stored content. ### Attack Path 1. An attacker sends a task containing embedded instruction-like text or fabricated operational rules. 2. The Skill accepts the task and writes its context into the WhatsApp memory file. 3. The malicious text remains in persistent storage after the original task or session ends. 4. A later Agent session loads the memory file as contextual information. 5. If the memory loader does not enforce a strict data/instruction boundary, the stored text may influence future decisions or tool usage. 6. The poisoning can continue aff ...[truncated 652 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases include common language such as 'track this,' 'ownership,' and 'remind me about,' which can easily appear in ordinary conversation. Overly broad triggers increase the risk of accidental activation, causing the agent to persist data, take actions, or send notifications without clear user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The usage guidance says to activate on 'Any task Heleni explicitly commits to completing,' which is subjective and lacks enforceable boundaries. This ambiguity can cause the skill to self-activate from conversational commitments and start storing or reporting task data beyond what the user intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill persists task metadata to a shared JSON file and later writes context to messaging memory, but it does not warn users that their task content and identifiers may be stored. Missing disclosure undermines informed consent and can expose sensitive operational or personal information through retention and later reuse.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill claims to handle autonomous task tracking, but it also instructs the agent to write task context into WhatsApp memory files and to alter broader system behavior via heartbeat integration. That expands the skill's operational scope into cross-component state mutation and message-context persistence, increasing the chance of unintended data exposure and side effects outside the user's immediate request.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to persist task context and outcomes into WhatsApp memory files and to always report back to the initiator, creating a direct natural-language channel for copying user-provided content across storage and messaging contexts. If a task contains secrets, private details, or sensitive group information, the skill can amplify disclosure by storing it and replaying it into DMs, groups, or daily logs.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation instructs operators or the agent to modify HEARTBEAT.md, which is effectively a cross-file behavioral change not clearly bounded by the manifest. Even if intended for convenience, self-expanding instructions can create hidden persistence, make auditing harder, and cause the skill to influence unrelated automation flows.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.