admin-assistant

• Outcome: Review
• Latest audit: Oct 2, 2026 · 5:06 PM UTC
• Version: 1.0.0

Overview

The skill is not overtly malicious, but it asks the agent to persist user work and perform broad autonomous administrative duties with recurring reminders and limited scoping.

Review this skill before installing if you do not want an agent to automatically track commitments, write local task/document records, or schedule recurring reminders. Configure the data directory and timezone deliberately, and require confirmation before using admin.py auto for business, finance, HR, compliance, inbox, filing, or deletion workflows.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code substantially matches only the task/calendar portion of the description: it supports adding tasks, assigning due dates/times, computing default reminders 6 hours before deadlines, rescheduling via drag/reschedule commands, marking states such as complete/pending, and generating activity-calendar views and reports. However, the declared description is much broader, claiming a personal administrative assistant with wellness guardrails, document-drafting tracking, and autonomous execution of many admin officer functions. None of those broader autonomous office-management capabilities are implemented here; this code is narrowly a task/reminder/calendar engine. Additionally, it has an undeclared operational feature of generating one-shot cron payloads to schedule reminders. While that cron support is related to reminders, the overall declared purpose materially overstates what the code actually does, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents a comprehensive personal admin assistant with many administrative and scheduling capabilities. The supplied code chunk only implements wellness functionality: configurable water/stretch reminders, working-hours/weekend gating, message rotation, config updates, status reporting, and reminder logging/reset. The wellness portion does align with one small part of the description, but the declared primary purpose is much broader and materially overstates what this code actually does. There are no obvious undeclared dangerous capabilities; the mismatch is that the implementation is substantially narrower than the declared behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script explicitly frames its purpose as generating and executing autonomous admin work 'without being asked,' which bypasses normal user-consent and approval boundaries for sensitive actions such as calendar, document, and task handling. In an agent setting, this can cause unauthorized actions on behalf of the user, especially when combined with duties marked as 'autonomous' and a top-down execution model.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares no explicit tool or permission boundaries despite instructing use of environment-controlled paths and persistent file writes under the workspace. In practice this leaves a broad admin skill able to modify local state and rely on ambient tool access without a least-privilege contract, increasing the chance of unintended file or environment abuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The invocation description is extremely broad and overlaps with ordinary requests for general assistance, making accidental activation and over-collection of user tasks or commitments more likely. In a skill that persists state and performs autonomous admin actions, vague triggering expands the chance of unintended actions being taken under an administrative context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions to 'track everything' and 'execute routine duties without being asked' create unsafe autonomy boundaries. In an admin-oriented skill, this can cause the agent to persist sensitive data, schedule actions, and initiate administrative workflows without clear user authorization, increasing privacy and integrity risk.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

Telling the agent to run any script with '-h' exposes an unnecessarily broad execution surface. Even if the referenced scripts are local, unrestricted script invocation in a skill that also manages files, reminders, and autonomous workflows can lead to unsafe commands being executed outside the intended task flow.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

| `scripts/docs.py` | Document-drafting register and stage machine |
| `scripts/admin.py` | Admin duty catalog, agendas, checklists, autonomous work order |

Run any script with `-h` for its full command list.

---

Tainted flow: 'tmp' from os.environ.get (line 111, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/_common.py (reported line 112)May include surrounding context.

python

def save(name: str, obj) -> None:
    p = fpath(name)
    tmp = p + ".tmp"
    with open(tmp, "w", encoding="utf-8") as fh:
        json.dump(obj, fh, ensure_ascii=False, indent=2)
    os.replace(tmp, p)

Tainted flow: 'p' from os.environ.get (line 86, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/_common.py (reported line 121)May include surrounding context.

python

p = fpath(name)
    record = dict(record)
    record.setdefault("at", iso(now()))
    with open(p, "a", encoding="utf-8") as fh:
        fh.write(json.dumps(record, ensure_ascii=False) + "\n")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The autonomous work-order generator aggregates overdue tasks, reminders, and document actions into an execution queue and instructs the agent to 'Execute top-down' without a clear user-facing warning that these items may trigger actions on the user's behalf. In the context of an admin assistant, this increases the risk of silent task manipulation, document handling, or other unintended administrative actions without informed approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The delete command permanently removes document records immediately after ID resolution, with no confirmation prompt, soft-delete, undo capability, or audit logging. In an admin-assistant context that performs routine officer duties and manages tracked drafting work, a mistyped or abbreviated ID can cause irreversible loss of operational records and disrupt accountability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The delete command permanently removes a task immediately after the user supplies an ID, with no confirmation prompt, soft-delete, or undo path. In an admin-assistant context that autonomously manages schedules and compliance tasks, an accidental or induced deletion can cause loss of important reminders, deadlines, and audit history, which can translate into missed obligations or operational disruption.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill sets the default timezone to Asia/Shanghai, which imposes a locale-specific default that may affect scheduling and reminders for users in other regions. The file does not indicate that this default is user-selected or justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code sets the default timezone to a specific locale, "Asia/Shanghai", whenever the ADMIN_ASSIST_TZ environment variable is unset. That imposes a locale-specific behavior by default rather than offering a neutral default or explicit user choice, which is a natural-language policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.