Security audit

Classislandcli

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to manage timetables, but it also exposes automatic activation, deletion/overwrite operations, and installation features that can change the user's agent or shell environment beyond normal schedule editing.

Review this skill carefully before installing. Use it only if you trust it to make timetable changes, and do not allow it to install completions, install/overwrite other skills, or delete subjects/layouts unless you explicitly requested that exact action and can recover from mistakes.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill exposes a `--InstallSkills` capability that installs or overwrites WorkBuddy skills, which is outside the stated timetable-management purpose and expands the blast radius from local schedule edits to agent-environment modification. In an auto-triggered skill, this creates a meaningful risk of unauthorized persistence or replacement of other skills if the agent invokes the command without strong user confirmation.

Context-Inappropriate Capability

Low

Confidence: 72% confidence
Finding: The `--InstallCompletions` command modifies the user's shell environment across multiple shells, which is unrelated to normal timetable operations and introduces unnecessary system-changing behavior. While lower risk than skill installation, it still allows the skill to perform persistent host configuration changes beyond the declared business function.

Vague Triggers

High

Confidence: 95% confidence
Finding: Using `auto` as the trigger makes this skill eligible to activate in unrelated conversations, increasing the chance that destructive commands or system-modifying operations are selected without clear user intent. This is especially dangerous here because the skill includes overwrite, delete, and installation features, so trigger overreach can translate directly into unintended actions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill documents destructive and overwrite-capable operations such as `--DeleteSubject`, `--DeleteTimeLayout`, and overwrite behavior in `--SetSubject`, but provides no confirmation, preview, or rollback guidance. In an agent setting, this increases the likelihood of accidental data loss from ambiguous requests, especially when combined with auto triggering.

Static analysis

No suspicious patterns detected.