Security audit

Agent Pool

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent agent-registry skill, but it can steer scraping, outreach, posting, email, and shared-memory workflows without enough approval or access boundaries.

Install only in a workspace where a global registry may guide research collection, outreach, posting, email, and shared-memory workflows. Before operational use, add explicit human approval for external collection and outbound actions, define per-agent trigger contracts, restrict write paths and shared knowledge-base access, and set retention/deletion and sensitive-data rules.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill metadata says it is triggered for broad cases like querying the agent list, orchestrating new flows, and onboarding new agents, but it does not define clear authorization or routing constraints. In an agent-pool registry that influences system orchestration, vague triggers can cause the wrong skill to activate and expose internal topology or drive unintended workflow changes.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: Many agents use generic trigger phrases such as 'CMO调度' or '系统流程调用' without concrete preconditions, boundaries, or safety gates. In a global agent pool, this increases the risk of misrouting tasks to powerful agents, including research, writing, and outbound-contact agents, which could lead to unintended data access, communications, or content generation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The file states that agent-produced data is written into the calling system directory, but it does not require disclosure, consent, or data handling limits. Hidden persistence is dangerous because users may provide sensitive business or personal data without realizing it will be stored, retained, and potentially reused across workflows.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The research agent is described as scraping, deduplicating, archiving, and writing results to a local knowledge base using multiple external sources, but the skill provides no privacy, legal, or data-minimization guidance. In context, this is more dangerous than ordinary content processing because it combines external collection with durable storage, creating risk of collecting personal data, copyrighted material, or sensitive competitive intelligence without user awareness.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The registry explicitly states that harvested and cleaned results are written into a local knowledge base, but it does not describe any approval gate, scope restriction, or warning that this agent performs persistent data modification. In an agent-pool context, silent writes to durable storage can cause unintended data poisoning, retention of sensitive scraped content, or compliance issues if upstream workflows invoke the agent assuming read-only research behavior.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file states that the knowledge base is shared and readable by all systems, which creates a clear cross-system data exposure path without describing access controls, classification rules, or tenant isolation. In a global agent pool, this is more dangerous because one agent's scraped or derived data can become broadly accessible to unrelated systems, enabling data leakage, contamination of downstream decisions, and privilege boundary erosion.

Static analysis

No suspicious patterns detected.