Security audit

pa-ownership

Security checks for vulnerabilities and agentic risk

Overview

This task-tracking skill is not clearly malicious, but it gives the assistant broad ongoing authority to store task details, retry work, and send WhatsApp updates without enough limits.

Install only if you want this assistant to keep a persistent task ledger, remember task context, retry blocked work through heartbeat checks, and send WhatsApp status messages. Before using it, narrow the triggers, remove or constrain the .context shell sourcing, require confirmation for high-impact tasks and retries, and add rules for redacting, deleting, and limiting sensitive task details.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes generic phrases like "ownership," "track this," "add to my tasks," and "remind me about," which are common in normal conversation and likely to cause accidental activation. In this skill, accidental activation is more dangerous than usual because activation leads directly to persistent task creation, memory writes, and later outbound reporting, creating privacy and integrity risks from unintended task capture.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The usage section expands activation beyond fixed triggers with conditions like "Any task Heleni explicitly commits to completing," which is subjective and hard to bound. That ambiguity can cause the agent to infer ownership from ordinary dialogue and then persist, retry, and report on content the user did not intend to enroll in a tracking workflow.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill persists tasks to a workspace file and later writes related context to memory without any disclosure, consent, retention limit, or data minimization rule. Because the skill is designed to capture task descriptions and outcomes, it may store sensitive personal, business, or group-chat information indefinitely in local files.

Ssd 3

Medium

Confidence: 97% confidence
Finding: These instructions require reporting results back to initiators and writing outcomes to WhatsApp memory files with no guardrails on sensitive content, recipient appropriateness, or channel separation. In a messaging environment, that can leak confidential task details into group chats, personal memory stores, or to the wrong recipient if initiation context is misidentified or if the task contains secrets.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The rule to "Persist everything" is a blanket retention directive that encourages saving all task state and context regardless of sensitivity. Combined with heartbeat scanning and reporting behavior, this broad retention increases the blast radius of any accidental capture, unauthorized file access, or later replay of sensitive information.

Static analysis

No suspicious patterns detected.