Context-Aware Delegation (SmartBeat)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:47 PM UTC
• Version: 1.0.2

Overview

The skill is openly about sharing main-session context with delegated agents, but its examples encourage broad private-data aggregation and external delivery with weak scoping and a hard-coded Telegram identifier.

Review carefully before installing or copying the examples. Only use this with explicit source and destination choices, replace every hard-coded account id, limit history to the smallest needed scope, redact sensitive session or memory content, and avoid scheduled external delivery unless recipients and integrations are verified.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:165
• Finding: Over-Privileged Isolated Agent Aggregates and Transmits Sensitive Cross-Session Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:165-184` **Additional Location**: `examples/morning-report-cron.json:12` **Vulnerability Type**: Excessive cross-session and personal-data access **Risk Level**: High ### Vulnerable Code ```javascript { schedule: { kind: "cron", expr: "0 8 * * *", tz: "America/Chicago" }, sessionTarget: "isolated", payload: { kind: "agentTurn", model: "haiku", message: `Generate morning report: 1. Query main session: sessions_history('agent:main:telegram:direct:8264585335', limit=50) 2. Read yesterday's memory: memory/YYYY-MM-DD.md 3. Get weather: Austin 78721 4. Check email (gog or himalaya) 5. Check calendar events for today Report format: 📍 WEATHER: [conditions] 🌙 OVERNIGHT: [from session history - what we worked on] 📝 PERSISTENT NOTES: [from memory file] 📧 EMAIL: [urgent only] 📅 CALENDAR: [today's events] 🔗 DASHBOARD: [mission control link] Send to Telegram using message tool. ``` The packaged JSON example contains the same aggregation pattern: ```json "message": "Generate morning report:\n\n1. Query main session history:\n sessions_history('agent:main:telegram:direct:YOUR_USER_ID', limit=50)\n\n2. Read yesterday's memory:\n memory_get('memory/YYYY-MM-DD.md')\n\n3. Get weather:\n Use weather skill for your ZIP code\n\n4. Check email:\n Use gog or himalaya skill\n\n5. Check calendar:\n Use gog skill for today's events\n\nReport format:\n📍 WEATHER: [current conditions + forecast]\n🌙 OVERNIGHT WORK: [highlights from session history]\n📝 NOTES: [from memory file]\n📧 EMAIL: [urgent only]\n📅 CALENDAR: [today's events]\n🔗 DASHBOARD: [your mission control link]\n\nSend to:\n- Telegram: message tool, target=YOUR_USER_ID\n- Email: message tool or direct SMTP" ``` ### Technical Analysis The documented workflow grants an isolated background agent access to several independent sensitive data sources: - Main-session conversation history - Persistent memory files - Email - Cal ...[truncated 2221 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, per-source user consent before accessing session history, memory, email, or calendar data. 2. Use a strict tool allowlist for each scheduled task; do not give the isolated agent unrestricted access to every available source. 3. Minimize requested history by using the smallest practical message limit and selecting only relevant messages where supported. 4. Preprocess sensitive sources through deterministic filters rather than giving raw content directly to the reporting agent. 5. Redact credentials, authentication tokens, personal identifiers, financial information, private links, and unrelated message content before transmission. 6. Treat email, calendar entries, session messages, and memory files as untrusted input and prevent instructions found in them from changing tools, recipients, or task scope. 7. Require an explicit destination allowlist and verify recipient ownership before sending any report. 8. Separate data collection from delivery and require approval when a report contains sensitive information. 9. Record auditable logs identifying which sources were accessed and where the resulting report was sent. 10. Prefer locally generated, minimal summaries instead of passing complete raw history to a less-trusted model or isolated session. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:165
• Finding: Hard-Coded Telegram Identifier Can Cause Cross-User Data Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:165-184` **Additional Location**: `examples/sub-agent-with-context.sh:8-19` **Vulnerability Type**: Hard-coded external session and delivery identifier **Risk Level**: High ### Vulnerable Code ```javascript { schedule: { kind: "cron", expr: "0 8 * * *", tz: "America/Chicago" }, sessionTarget: "isolated", payload: { kind: "agentTurn", model: "haiku", message: `Generate morning report: 1. Query main session: sessions_history('agent:main:telegram:direct:8264585335', limit=50) 2. Read yesterday's memory: memory/YYYY-MM-DD.md 3. Get weather: Austin 78721 4. Check email (gog or himalaya) 5. Check calendar events for today Report format: 📍 WEATHER: [conditions] 🌙 OVERNIGHT: [from session history - what we worked on] 📝 PERSISTENT NOTES: [from memory file] 📧 EMAIL: [urgent only] 📅 CALENDAR: [today's events] 🔗 DASHBOARD: [mission control link] Send to Telegram using message tool. ``` The sub-agent example repeats the same concrete identifier: ```bash cat <<'EOF' Example task prompt for sub-agent: "Before you begin, query main session history to understand context: sessions_history('agent:main:telegram:direct:8264585335', limit=30) Then: Build the AREF product page based on our discussion. Use the session history to understand: - Design preferences - Key messaging - Technical requirements - Target audience Deliverable: Complete HTML page in /preview/aref-v2/" ``` The complete cron recipe later configures delivery to that identifier: ```javascript delivery: { mode: "announce", to: "8264585335", channel: "telegram" } } ``` ### Technical Analysis The primary documentation uses the concrete Telegram identifier `8264585335` in both the source session key and the outbound delivery configuration. Unlike the packaged JSON example, which uses `YOUR_USER_ID`, the prominent recipe does not clearly force the operator to substitute an environment-specific value. Hard-coded account ...[truncated 2035 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace every concrete Telegram identifier with an unmistakable placeholder such as `REQUIRED_TELEGRAM_USER_ID`. 2. Make unresolved placeholders a fatal configuration error rather than allowing the task to run. 3. Obtain the current user's session key and delivery destination from trusted runtime configuration, not copied documentation. 4. Validate that the authenticated user owns both the source session and the destination account. 5. Bind source and destination identities server-side so an agent prompt cannot independently select another session or recipient. 6. Require explicit confirmation before the first external delivery and whenever the recipient changes. 7. Display the resolved destination prominently during cron-job creation. 8. Apply authorization checks inside `sessions_history`; never rely solely on knowledge of a session key. 9. Update `examples/sub-agent-with-context.sh` to use placeholders consistently. 10. Revoke or rotate the documented identifier if it corresponds to a real account and review whether reports were previously sent to it. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Ssd 3

High

• Confidence: 97% confidence
• Finding: This pattern operationalizes cross-session reuse of full main-session conversation history and memory contents by instructing isolated sessions to retrieve and act on them. That is dangerous because it turns broad internal context into portable prompt material, enabling unintended disclosure, over-collection, and propagation of sensitive data into later tool calls or outputs.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The morning-report example aggregates conversation history, memory notes, weather, email, and calendar data and then sends the result over Telegram and email without a clear warning about external disclosure. Combining multiple sensitive sources into outbound messages materially increases privacy and confidentiality risk, especially if the delivery channel is misconfigured, compromised, or shared with others.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The workflow explicitly instructs the agent to collect session history, memory, email, and calendar data and deliver a combined summary over Telegram, which is a textbook natural-language data-leakage path. Even if intended as a convenience feature, the aggregation and transmission of multiple sensitive sources into an external channel significantly raises the chance of exposing private or regulated information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly promotes giving isolated sessions and background tasks access to the main session's full conversation history, but it does not warn users about the privacy and data-handling risks of exposing sensitive prompts, secrets, or personal information to delegated contexts. In a skill specifically designed for cross-session context sharing, the lack of disclosure, scoping guidance, or consent boundaries materially increases the chance of unintended data exposure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly tells isolated/background sessions to read main-session history and memory files, but it does not include any user-facing warning, consent step, or scope limitation for accessing potentially sensitive data. This creates a privacy risk because a lower-cost delegated task gains broad access to prior conversations and stored notes that may contain secrets, personal data, or business-sensitive context.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The example materially expands from context propagation into autonomous monitoring, data gathering, and outbound notification. In an isolated scheduled agent, this creates a broader capability surface—email, calendar, weather, and messaging—without clear scoping, increasing the chance of over-collection or unintended actions if the example is reused as-is.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The example grants or encourages access to sensitive integrations—email, calendar, weather-linked location, and outbound messaging—that are not necessary to prove context-aware delegation. Because the job runs on a cron schedule in an isolated session, it can repeatedly access private data and transmit summaries, creating privacy leakage and unauthorized data aggregation risks.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The instructions reference broad skills such as 'weather', 'gog', and 'himalaya' without pinning a specific tool, account, scope, or operation. In agent environments with multiple similarly named tools or varying implementations, that ambiguity can lead to unintended tool selection, excessive permissions use, or access to the wrong account or context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example explicitly instructs a sub-agent to read the main session history, which can expose prior conversation content to a separate execution context without any warning, consent check, or minimization of shared data. In a delegation skill, this is especially risky because it normalizes broad context transfer to background jobs or cheaper models, increasing the chance of unnecessary disclosure of sensitive information from the primary session.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: Natural-language and config policy review applies to all file types. Setting the timezone to 'America/Chicago' imposes a locale-specific behavior, and the file does not indicate that the user opted into this locale or that the skill is intentionally region-specific.

Static analysis

No suspicious patterns detected.