Security audit

workbuddy-skill-session-callback

Security checks across malware telemetry and agentic risk

Overview

The skill is open about its purpose, but it can inject messages into other live WorkBuddy sessions and trigger agents without built-in confirmation or target opt-in.

Install only if you intentionally want local automation to wake and message other WorkBuddy sessions. Use fixed, trusted callback messages, restrict targets to known session IDs, keep endpoints on 127.0.0.1, avoid feeding external input into the script, and add your own confirmation/allowlist controls for sensitive sessions or recurring automations.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill describes concrete file-read and local network capabilities, including reading WorkBuddy session metadata under ~/.workbuddy and connecting to per-session localhost ACP endpoints, but it declares no permissions. That mismatch is security-relevant because the skill enables cross-session message injection and access to local session state without transparent capability declaration, weakening review and consent controls.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The documentation explicitly states that localhost/127.0.0.1 requests to ACP endpoints do not require authentication, while the same skill is designed to inject prompts into other active sessions. That combination enables any local process running under the user context to wake or influence a session without an approval step, creating strong integrity and privacy risk for ongoing agent work.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The reference material documents transcript storage paths and states that prior discussion context is fully carried into the injected prompt flow, but does not include privacy or data-handling warnings. This increases the chance that users or integrators unknowingly expose sensitive conversation history on disk or reuse it across automations and sessions.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script deliberately loads another WorkBuddy session and injects a user message into it, changing that session's state and causing its agent to act with the full prior context. In this local WorkBuddy environment, the operation is effectively a cross-session command channel with no user confirmation, authorization boundary, or safety interlock, so misuse could trigger unintended actions, data exposure, or persistence of attacker-controlled prompts into another session transcript.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script obtains a connection ID and session token from the local ACP endpoint and immediately uses them to operate on the target session, without warning the user that sensitive session credentials are being acquired and exercised. Although intended for local automation, these tokens authorize privileged session actions; if exposed via logs, process inspection, malicious local code, or reuse in other tooling, they could enable unauthorized interaction with the target session.

Ssd 4

High

Confidence: 97% confidence
Finding: This reference describes an end-to-end procedure for connecting to a live session, loading it, injecting a prompt, and relying on queued delivery until the session becomes idle. In context, that is not just diagnostic documentation; it operationalizes covert cross-session influence with persistence, making unauthorized action steering and exfiltration materially easier if any local process is compromised or untrusted.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.