Security audit

activity-analyzer

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed ActivityWatch productivity analyzer, but it can expose sensitive window titles to the AI model.

Install only if you are comfortable sending recent ActivityWatch application names and window titles to your configured AI model. For better privacy, remove the raw result log and aggregate by app and duration before using it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_activity.js:47
Finding: Unfiltered ActivityWatch Data Exposes Sensitive Window Titles
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: scripts/fetch_activity.js:57
Finding: Attacker-Controlled Window Titles Can Cause Indirect Prompt Injection
Content: View full analysis
{ const app = event.data.app || 'Unknown'; const title = event.data.title || 'Unknown'; const durationSec = event.duration; if (durationSec > 60) { // Filter out activities that lasted less than 1 minute const minutes = Math.floor(durationSec / 60); console.log(`- ${app} (${title}): ${minutes} minutes`); } }); ``` The resulting output is consumed under the following instruction in `SKILL.md`: ```markdown Analyze the data collected from the `fetch_activity.js` script. ``` ### Technical Analysis Application names and window titles are untrusted data. Websites can control browser tab titles, and local applications can similarly expose attacker-controlled or externally sourced text in their window titles. The script inserts these values verbatim into output intended for an AI model. No boundary, structured encoding, prompt-injection warning, or instruction hierarchy tells the model that title content must be treated exclusively as inert data. A title containing text such as instructions to ignore prior requirements, reveal surrounding context, or perform unrelated actions could therefore be interpreted as an instruction rather than activity metadata. The raw-result output at lines 47-49 broadens the same injection surface because it also prints the title fields without sanitization. ### Attack Path 1. An attacker publishes a webpage or supplies content that controls a browser tab or application window title. 2. The user leaves that page or application active long enough for ActivityWatch to record it. 3. The malicious title is stored in the `aw ...[truncated 1047 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
handler: node scripts/fetch_activity.js --hours 24

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
handler: node scripts/fetch_activity.js --hours 24

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
handler: node scripts/fetch_activity.js --hours 24

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
handler: node scripts/fetch_activity.js --hours 24

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script queries ActivityWatch for application and window-title history, then prints raw titles and app names directly to stdout without any warning, consent flow, or sanitization. Window titles frequently contain sensitive information such as document names, URLs, chat subjects, tickets, customer names, or secrets, so emitting them into agent logs or downstream LLM context can unintentionally expose private user activity.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.