Security audit

Pa Status

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly read-only PA status helper with clear operational caveats, not hidden or destructive behavior.

Install only where the PA directory and WhatsApp reachability checks are authorized. Treat generated reports as advisory until the script validates last_seen and calendar_connected, and require explicit confirmation before sending pings or distributing status reports.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:23
Finding: Incomplete Health Validation Produces False Healthy Status Reports
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrase "what's the status?" is broad enough to match ordinary conversation and may cause the skill to run unintentionally. In an agent environment, ambiguous triggers can lead to unnecessary access to operational data and accidental report generation when the user did not intend to invoke this specific skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents health checks for last_seen, calendar_connected, and status, but the script only partially enforces them and treats some unhealthy states as healthy. This creates a false sense of monitoring coverage, allowing stale or disconnected PAs to be reported as online and delaying incident detection.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is described as a read-only dashboard over a local JSON file, but it also instructs operators to send outbound WhatsApp messages to PAs. This expands the skill from passive monitoring into external interaction, creating a risk of unintended messaging, data disclosure, and action beyond the user's expected trust boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The WhatsApp ping workflow directs the operator or agent to contact external parties without warning about external transmission, consent, or data handling. Even a simple ping confirms operational relationships and can leak metadata about internal monitoring activity to third parties or trigger unintended communication.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The 'When to Run' section states that on billing error the skill should send a partial report for the affected PA. The included script has no filtering or targeted-report capability; it always iterates over every PA in pa-directory.json and prints a network-wide report.
Content: No source excerpt is available for this finding.