T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:165- Finding
Over-Privileged Isolated Agent Aggregates and Transmits Sensitive Cross-Session Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Context-Aware Delegation (SmartBeat)
Security checks for vulnerabilities and agentic risk
Overview
The skill is openly about sharing main-session context with delegated agents, but its examples encourage broad private-data aggregation and external delivery with weak scoping and a hard-coded Telegram identifier.
Review carefully before installing or copying the examples. Only use this with explicit source and destination choices, replace every hard-coded account id, limit history to the smallest needed scope, redact sensitive session or memory content, and avoid scheduled external delivery unless recipients and integrations are verified.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:165- Finding
Hard-Coded Telegram Identifier Can Cause Cross-User Data Disclosure
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This pattern operationalizes cross-session reuse of full main-session conversation history and memory contents by instructing isolated sessions to retrieve and act on them. That is dangerous because it turns broad internal context into portable prompt material, enabling unintended disclosure, over-collection, and propagation of sensitive data into later tool calls or outputs.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The morning-report example aggregates conversation history, memory notes, weather, email, and calendar data and then sends the result over Telegram and email without a clear warning about external disclosure. Combining multiple sensitive sources into outbound messages materially increases privacy and confidentiality risk, especially if the delivery channel is misconfigured, compromised, or shared with others.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow explicitly instructs the agent to collect session history, memory, email, and calendar data and deliver a combined summary over Telegram, which is a textbook natural-language data-leakage path. Even if intended as a convenience feature, the aggregation and transmission of multiple sensitive sources into an external channel significantly raises the chance of exposing private or regulated information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly promotes giving isolated sessions and background tasks access to the main session's full conversation history, but it does not warn users about the privacy and data-handling risks of exposing sensitive prompts, secrets, or personal information to delegated contexts. In a skill specifically designed for cross-session context sharing, the lack of disclosure, scoping guidance, or consent boundaries materially increases the chance of unintended data exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly tells isolated/background sessions to read main-session history and memory files, but it does not include any user-facing warning, consent step, or scope limitation for accessing potentially sensitive data. This creates a privacy risk because a lower-cost delegated task gains broad access to prior conversations and stored notes that may contain secrets, personal data, or business-sensitive context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example materially expands from context propagation into autonomous monitoring, data gathering, and outbound notification. In an isolated scheduled agent, this creates a broader capability surface—email, calendar, weather, and messaging—without clear scoping, increasing the chance of over-collection or unintended actions if the example is reused as-is.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The example grants or encourages access to sensitive integrations—email, calendar, weather-linked location, and outbound messaging—that are not necessary to prove context-aware delegation. Because the job runs on a cron schedule in an isolated session, it can repeatedly access private data and transmit summaries, creating privacy leakage and unauthorized data aggregation risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instructions reference broad skills such as 'weather', 'gog', and 'himalaya' without pinning a specific tool, account, scope, or operation. In agent environments with multiple similarly named tools or varying implementations, that ambiguity can lead to unintended tool selection, excessive permissions use, or access to the wrong account or context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example explicitly instructs a sub-agent to read the main session history, which can expose prior conversation content to a separate execution context without any warning, consent check, or minimization of shared data. In a delegation skill, this is especially risky because it normalizes broad context transfer to background jobs or cheaper models, increasing the chance of unnecessary disclosure of sensitive information from the primary session.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Natural-language and config policy review applies to all file types. Setting the timezone to 'America/Chicago' imposes a locale-specific behavior, and the file does not indicate that the user opted into this locale or that the skill is intentionally region-specific.
- Content
Static analysis
No suspicious patterns detected.