Security audit

Colleague.skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is locally stored and not overtly malicious, but it creates persistent profiles about coworkers with loose activation rules and incomplete privacy and file-safety controls.

Install only if you are comfortable maintaining local coworker profiles and your workplace policies allow it. Avoid recording sensitive personal information, rumors, health or stress speculation, HR-like judgments, or data about people who have not reasonably consented; use safe profile identifiers instead of raw names and periodically delete stale profiles.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:52
Finding: Unsanitized Colleague Name Used in Persistent File Paths
Content: View full analysis
Storage: `~/.colleague-skill/colleagues/[name]/interaction-log.jsonl` ``` ### Technical Analysis The Skill instructs the Agent to insert a user-provided colleague name directly into a filesystem path. It does not require validation, canonicalization, safe identifier generation, or verification that the resolved path remains under `~/.colleague-skill/colleagues/`. A crafted name containing path separators, traversal components such as `../`, an absolute path, or a path resolving through a symbolic link could cause the resulting `PROFILE.md` or `interaction-log.jsonl` operation to target a location outside the intended colleague directory. For example, a name conceptually equivalent to `../../target-directory` would produce a path resembling: ```text ~/.colleague-skill/colleagues/../../target-directory/PROFILE.md ``` After path normalization, this no longer resides beneath the intended `colleagues` directory. The exact exploitability depends on how the host Agent implements the documented file operations and which filesystem permissions it possesses. ### Attack Path 1. An attacker or untrusted user supplies a crafted colleague name containing traversal components or path separators. 2. The Agent follows the Skill instruction to create or update `colleagues/[name]/PROFILE.md` and `colleagues/[name]/i ...[truncated 1145 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly promotes persistent storage of coworker work styles, decision patterns, and institutional knowledge, including after they leave, but does not warn about consent, data sensitivity, retention limits, or workplace privacy risks. Even if stored locally, these profiles can contain subjective assessments and sensitive employment-related inferences that may be misused, leaked, or retained beyond appropriate business need.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The examples encourage users to infer causes, triggers, and likely reactions of coworkers from observed behavior without caution about uncertainty, bias, or appropriate boundaries. This can normalize speculative profiling and lead to inaccurate or unfair conclusions that affect workplace interactions, evaluations, or conflict handling.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 93% confidence
Finding: The skill explicitly supports local persistence, cross-session loading, iterative refinement, and detailed logging of colleague observations, creating a durable repository of behavioral profiles and institutional knowledge about identifiable coworkers. Even without external exfiltration, this is dangerous because sensitive workplace inferences can accumulate over time, be reused beyond the original context, and expose private or reputation-affecting information to anyone with local access.
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
### Problem-Solving Style - **Thinking**: top-down (answer-first) / bottom-up (data-first) - **Processing**: visual thinker / verbal thinker / needs to write - **Approach**: solo solver / talks through problems - **Crisis Response**: calm / action-oriented / needs to process

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger for Profile Building Mode is broad enough to activate on ordinary conversation about a coworker, which can cause the skill to begin collecting and persisting profile data without a clear, deliberate opt-in. In this skill’s context, that is risky because the stored data concerns identifiable colleagues and behavioral profiling, so accidental activation directly increases privacy and consent concerns.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The present-colleague advice mode is ambiguously triggered by general requests about collaborating with or understanding a colleague, which could capture normal workplace discussion and unnecessarily consult or update a stored behavioral profile. Because this skill is designed to accumulate institutional memory across sessions, a loose trigger can turn routine assistance into implicit profiling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Departure Mode activates on general mentions of former colleagues, which is overly broad for a mode that retrieves preserved profiles and institutional knowledge about people who are no longer present to correct or contextualize the record. This increases the chance of inappropriate retention use, over-reliance on stale inferences, and disclosure of sensitive internal knowledge from casual references.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The team-dynamics trigger is vague enough to match common workplace discussion, potentially causing the skill to analyze, compare, and persist interpersonal assessments without a narrowly scoped request. In a profiling-oriented skill, broad activation is especially sensitive because it can generate or expose composite judgments about multiple employees at once.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The template explicitly instructs persistent storage of detailed coworker interaction logs, including behavioral observations, feedback style, stress signals, and second-hand reports, but provides no privacy, consent, retention, access-control, or sensitivity handling guidance. In this skill’s context, the accumulated profile can become a surveillance dossier containing personal and potentially sensitive workplace inferences, increasing risk of misuse, unauthorized access, and harmful decision-making about employees.
Content: No source excerpt is available for this finding.