Security audit

Causal Inference

Security checks for vulnerabilities and agentic risk

Overview

This skill is related to causal analysis, but it broadly logs user activity and can ingest private email, calendar, and message history with weak scoping and unsafe temporary-file handling.

Review before installing. Only use this skill if you are comfortable with an agent building a persistent behavioral log from actions and historical communications. Avoid running broad backfills until the scope, retention period, deletion process, and storage location are explicit, and replace the fixed /tmp export paths with secure temporary files or in-memory processing.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/backfill_email.py:168
Finding: Predictable Temporary Files Expose Private Communication Data and Permit Symlink Attacks
Content: View full analysis
/tmp/sent_emails.json gog calendar list --after 2024-01-01 --format json > /tmp/events.json wacli search --after 2024-01-01 --from me --format json > /tmp/wa_sent.json ``` ### Technical Analysis The scripts store raw email, calendar, and messaging exports under fixed, globally predictable names in `/tmp`. Python's `open(path, "w")` does not create the file exclusively and normally follows symbolic links. Shell redirection in the documented commands has equivalent risks. Consequently, another local user who can write to the shared temporary directory may create the expected path before the script runs. Depending on operating-system hardening, the path may be a symbolic link to another file writable by the account running the backfill process. Opening it in write mode can truncate and replace that target. The files also are not removed after processing. Their access permissions depend on the process umask rather than an explicit restrictive mode. If created with permissions such as `0644`, another local user may read the residual export. ...[truncated 2047 chars]
Remediation: View remediation
"$tmp_file" python3 scripts/backfill_email.py "$tmp_file" ``` 6. **Apply the correction consistently** to email, calendar, and messaging backfills, and advise users not to e ...[truncated 48 chars]

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description promises a general-purpose causal reasoning skill that should activate on many kinds of agent actions and help with intervention planning, failure debugging, outcome prediction, historical backfilling, and retrospective understanding. The actual code does not monitor or trigger on actions at all. It is a standalone analysis script that reads a specific local log file, extracts variables from logged records, and computes a simple two-group average treatment effect with rough uncertainty estimates. This is related to causal analysis and retrospective historical data analysis, so it is not wholly unrelated. However, the implemented behavior is materially narrower than the declared purpose: no broad trigger behavior, no real-time action support, no intervention planning logic, no generic counterfactual reasoning, and no backfilling functionality beyond reading existing logs. Therefore the description overstates the implemented capability enough to count as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description emphasizes an active causal reasoning skill that should be used to analyze actions and outcomes, predict what will happen, understand failures, and support intervention planning across many action types. The supplied code does not implement any reasoning or analysis behavior. It simply appends a structured event record to a local JSONL file. While this logging could support later causal analysis or historical backfilling, the code’s actual primary purpose is event logging, not causal reasoning. Therefore the description materially overstates the implemented functionality.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill says to trigger on ANY high-level action, which is so broad that it could attach itself to routine user operations across communication, files, calendar, and purchases. In an agentic system, overbroad activation increases the chance of unnecessary data access, excessive logging, unintended interference with other skills, and use in contexts the user did not meaningfully consent to.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The activation language is ambiguous and expansive, covering nearly all common productivity actions without precise limits. That makes the skill more dangerous in context because it is designed to observe broad user activity and could be invoked in privacy-sensitive situations such as messages, meetings, file edits, and purchases.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill includes shell commands and file-writing behavior but does not declare any explicit tool scope or permissions boundaries. In an agent environment, this can lead to unexpected execution capability and makes it harder to enforce least privilege or review what the skill is allowed to touch.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill promotes broad collection and persistent retention of communication history, calendar events, message activity, and action outcomes across multiple domains. In this context, that creates a substantial privacy and surveillance risk, especially because the trigger scope is already extremely broad and the stored data could enable profiling, inference of sensitive relationships, or secondary misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The backfill instructions direct parsing of historical emails, calendars, and message history without any privacy warning, minimization guidance, or consent requirement. This is risky because these sources commonly contain sensitive personal, business, and third-party data, and the skill context explicitly encourages broad retrospective collection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill requires persistent logging of action context, pre-state, post-state, and outcomes to a JSONL log but does not warn about retention, access control, or sensitivity of stored metadata. Even if raw message bodies are not logged, behavioral history can reveal relationships, schedules, priorities, and business activity over time.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/backfill_calendar.py (reported line 164)May include surrounding context.
python
"""Backfill by querying gog directly.""" after_date = (datetime.now() - timedelta(days=days)).strftime("%Y-%m-%d") result = subprocess.run( ["gog", "calendar", "list", "--after", after_date, "--format", "json"], capture_output=True, text=True )

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script writes calendar export data to a predictable path under /tmp without access controls, which can expose sensitive meeting metadata to other local users or processes on shared systems. In this skill context, calendar history may contain private titles, times, attendees, and conferencing details, making undisclosed local persistence more dangerous.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script persistently writes derived email activity records to a local action log without an explicit warning, confirmation, or visibility into what data will be stored. In a causal-inference skill, this increases sensitivity because even metadata such as timing, reply status, recipient type, and subject length can reveal communication patterns and create a durable privacy footprint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Directly querying Gmail history causes the script to collect and process mailbox data without explicit user-facing disclosure at the point of execution. In this skill context, the danger is elevated because the skill is designed to backfill historical actions for analysis, which can silently ingest broad communication metadata into downstream memory/logging systems.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/backfill_email.py (reported line 149)May include surrounding context.
python
after_date = (datetime.now() - timedelta(days=days)).strftime("%Y-%m-%d") # Get sent emails result = subprocess.run( ["gog", "gmail", "list", "--sent", "--after", after_date, "--format", "json"], capture_output=True, text=True )

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/backfill_email.py (reported line 161)May include surrounding context.
python
sent_emails = json.loads(result.stdout) if result.stdout.strip() else [] # Get all emails for reply checking result = subprocess.run( ["gog", "gmail", "list", "--after", after_date, "--format", "json"], capture_output=True, text=True )

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Writing email-derived metadata to a predictable fixed file in /tmp can expose sensitive data to other local users, enable accidental reuse/stale-data issues, and create symlink or overwrite hazards depending on the environment. Because the file contains mailbox-derived records and is placed in a shared temporary namespace, this is a real local confidentiality and integrity risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script persistently writes metadata derived from private message history into memory/causal/action_log.jsonl without any consent prompt, warning, minimization, or access-control check. In this skill context, message history is sensitive behavioral data, and silently backfilling it into a long-lived memory store increases privacy exposure and the blast radius of later compromise or misuse.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/backfill_messages.py (reported line 150)May include surrounding context.
python
"""Backfill from WhatsApp via wacli.""" after_date = (datetime.now() - timedelta(days=days)).strftime("%Y-%m-%d") result = subprocess.run( ["wacli", "search", "--after", after_date, "--limit", "1000", "--format", "json"], capture_output=True, text=True )

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code exports WhatsApp message history to a predictable temporary file in /tmp, creating an unadvertised local copy of sensitive communications. In a multi-user or loosely controlled environment, this increases the chance of unintended disclosure, leftover forensic artifacts, or tampering before the file is consumed.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
## When to Trigger **Trigger this skill on ANY high-level action**, including but not limited to: | Domain | Actions to Log | |--------|---------------|

Static analysis

No suspicious patterns detected.