T09 · Insecure Skill Coding Practices
Warning
- Location
templates/obsidian-tracking.md:43- Finding
Confidential Personnel and Behavioral Records Stored in Plaintext Markdown Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Team Status Tracker
Security checks for vulnerabilities and agentic risk
Overview
This skill is not overtly malicious, but it should be reviewed because it can use Slack access and store named workplace behavior and response records in Obsidian without enough privacy or retention safeguards.
Install only if your organization has approved this kind of personnel-status tracking and Slack access. Configure Slack scopes narrowly, verify the Maton gateway is trusted, store notes in a protected location, avoid subjective behavioral profiling unless explicitly authorized, and define retention and deletion outside the skill before use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file presents the skill as maintaining confidentiality while elsewhere allowing disclosure of project budgets and payment context when a flag is enabled. That contradiction undermines operator trust and can cause accidental oversharing of sensitive business information under the mistaken belief that the workflow remains confidentiality-preserving.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README encourages confidential internal tracking of individual response behavior, response times, and non-responder status without addressing employee privacy, notice, consent, retention, or misuse risks. In a workplace monitoring context, hidden behavioral profiling can create legal, HR, and trust issues, especially if the data is stored indefinitely or used for performance judgments beyond the original coordination purpose.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README broadens a confidentiality-focused skill to optionally disclose budget and payment context, creating a policy contradiction that can lead operators to reveal sensitive financial information to team members or contractors. In a status-tracking skill centered on confidential internal coordination, this ambiguity is dangerous because users may treat optional disclosure as endorsed safe behavior without clear authorization, access-control, or compliance boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the operator to collect, categorize, and persist personnel-related behavioral data such as response times, response quality, and 'behavioral patterns' in confidential Obsidian notes, but it does not include any warning about privacy, consent, retention, legal/compliance constraints, or appropriate HR governance. That creates a real privacy and employee-monitoring risk because users may deploy the workflow for covert profiling or performance surveillance without safeguards.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Slack API (via Maton Gateway)
bash # List users curl -X GET "https://gateway.maton.ai/slack/api/users.list" \ -H "Authorization: Bearer $MATON_API_KEY" # Send DM
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The configuration explicitly references behavioral tracking notes, response time metrics, and non-responder lists as categories of internal data, which indicates the skill is designed to collect or preserve employee-monitoring information even if it is not externally shared. In a team-status skill, this creates privacy and workplace-surveillance risk because sensitive behavioral data may be retained without clear consent, minimization, or governance controls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The config specifies
work_hours_startandwork_hours_endexplicitly in UTC, which imposes a specific locale/timezone assumption on users. Under the policy, forcing a locale-related setting without offering choice or documenting a justified regional constraint is a natural-language policy concern.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The template explicitly instructs the collection and retention of individual response times, response quality, behavioral notes, and non-responder lists, which are employee performance and behavioral monitoring data. Although it labels the file confidential, it does not include safeguards such as data minimization, retention limits, need-to-know access controls, or guidance to avoid subjective or unnecessary personal profiling, creating a real privacy and compliance risk.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Marking categories as 'NEVER share' does not reduce the risk created by collecting and retaining them internally; it instead confirms that the skill contemplates handling sensitive personnel-related data. This is dangerous because internal-only storage of behavioral or response-related notes can still enable misuse, unauthorized access, or policy violations if the data is unnecessarily preserved.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 62% confidence
- Finding
The natural-language instructions impose a rigid internal sharing policy such as 'Only share with founder' and 'DO NOT SHARE WITH TEAM MEMBERS' as absolute operational rules. Because SQP-3 covers organizational natural-language policy constraints, this appears as an undocumented policy directive embedded in the skill content without context or opt-in justification.
- Content
Static analysis
No suspicious patterns detected.