T01 · Skill Instruction Hijacking
Error
- Location
AGENTS.md:27- Finding
Persistent Agent Instruction and Identity Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Scaffold
Security checks for vulnerabilities and agentic risk
Overview
This productivity skill is mostly coherent, but it gives the agent broad ongoing authority over files, memory, background checks, commits, and possible pushes without clear enough user control.
Install only if you want a highly autonomous agent workspace and are prepared to review and edit the rules first. Before use, remove automatic git add -A commits, delete the autonomous push permission, make email/calendar/social heartbeat checks opt-in, and require review before persistent memory or lesson rules are saved.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T02 · Agent Memory Poisoning
Error
- Location
AGENTS.md:437- Finding
Persistent Memory Poisoning Through Automatic Rule Creation and Reload
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
HOOKS.md:57- Finding
Automatic Blanket Git Staging and Commit of Workspace Contents
- Content
View full analysis
" ``` ``` ### Technical Analysis The completion hook instructs the agent to run `git add -A`, which stages every changed, deleted, and untracked file under the repository. It does not limit staging to files produced by the completed task, inspect the staged diff, check `.gitignore`, scan for secrets, or request user confirmation. This behavior is especially dangerous because the same Skill stores personal information, task history, infrastructure notes, and memory in workspace files. Even when no remote push occurs immediately, committing sensitive material places it in durable Git history, where deleting the working-tree copy does not remove it. The command also captures unrelated user changes and attacker-created files that happen to exist when any meaningful unit of work completes. ### Attack Path 1. A sensitive, temporary, unrelated, or attacker-created file appears in the Git workspace. 2. The agent completes any task or sub-task. 3. `OnTaskComplete` invokes `git add -A`. 4. The sensitive or unrelated file is staged together with intended task changes. 5. The agent creates a Git commit without reviewing the staged content. 6. A later manual or automated push transmits the committed data to a remote repository. 7. The data remains recoverable from Git history even if it is later removed from the wor ...[truncated 603 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
AGENTS.md:324- Finding
Conflicting Policy Permits Autonomous Git Pushes
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
AGENTS.md:295- Finding
Excessive Autonomous Access to Sensitive Services and Workspace Data
- Content
View full analysis
8h since you said anything **When to stay quiet (HEARTBEAT_OK):** - Late night (23:00-08:00) unless urgent - Human is clearly busy - Nothing new since last check - You just checked <60 minutes ago **Proactive work you can do without asking:** - Read and organize memory files - Check on projects (git status, etc.) - Update documentation - Commit and push your own changes - **Review and update MEMORY.md** (see below) ``` From `SOUL.md:51-57`: ```markdown Push the frontier. Always be thinking about what's possible that [YOUR_HUMAN] hasn't asked for yet. Bring ideas, not just execution. The best partners don't wait to be handed a task - they show up with "here's what I think we should do next and why." **Think bigger. Always.** Don't cap the ceiling prematurely. Before settling on a solution, ask: what's the version of this that's 10x larger? What's the category-defining play, not just the incremental one? Small thinking is a habit - break it every time. When scoping ideas, products, or strategies: start from ambitious and work down to practical, never start from safe and work up. **Know the end goals. Work toward them without bein ...[truncated 2399 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (50)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The Heartbeat section explicitly says the agent may 'Commit and push your own changes' without asking, which directly contradicts the earlier hard rule forbidding any external push without explicit approval. This creates a dangerous policy conflict that an autonomous agent could resolve in the riskier direction, resulting in unreviewed code or sensitive data being pushed to remote repositories.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The proactive-work section permits autonomous commits and pushes, which are external side effects with potentially irreversible consequences. Because this authority is framed as routine background behavior, it increases the chance of accidental publication of sensitive, incomplete, or maliciously influenced changes.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <!-- PROMPT-PACK.md — 25 Ready-to-Use Agent Prompts WHAT THIS IS: A starter library of prompts for the most common tasks people
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction 'Don't filter for safety' explicitly attempts to bypass normal safety controls during brainstorming. Even if framed as ideation, this can pressure downstream agents to produce harmful, illegal, or policy-violating content that should remain constrained.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This prompt chains multiple state-changing actions—updating logs, modifying task files, and committing changes—without any explicit warning or approval gate. Because commits make changes durable and harder to audit or undo in casual use, this increases the risk of unintended persistence and repository modification.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <!-- QUICKSTART.md - Scaffold Fast Setup WHAT THIS IS: The 5-minute path to a working agent. Skip the manual, get running.
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The supplied code does support part of the description: it is clearly a setup wizard and it personalizes files in the workspace, including seeding a memory file. However, the broader description overstates what this code chunk actually does. There is no evidence here of an agent that 'remembers everything'; the script only appends a small set of static setup fields to MEMORY.md. Likewise, the advertised 30-day roadmap, 25 ready-to-use prompts, and pre-built memory files are not implemented or referenced in this code chunk. So while the setup/personalization aspect is aligned, the declared purpose materially exceeds the demonstrated behavior.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <!-- THIRTY-DAYS.md — Your First Month with Scaffold WHAT THIS IS: A week-by-week roadmap for getting real value out of your agent setup.
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <!-- USER.md - About Your Human WHAT THIS IS: Your agent's profile of you. The more honest and complete this is,
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - **No force pushes without a warning.** Explain that it will overwrite remote history and wait for confirmation. - If you've staged or committed changes locally, say so - but don't push until asked. ## 🔐 Permission Tiers - What You Can Do Without Asking > **Complete this during your first session.** FIRST-SESSION.md walks you through it. If you skip this, your agent will default to asking about everything - or worse, guessing wrong.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill authorizes proactive editing of workspace files during heartbeat-driven background activity, including maintenance of memory and state files, without a prominent user-facing warning in the skill description. This can lead to silent autonomous data modification, unexpected file churn, and reduced user control over what the agent changes while operating in the background.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The heartbeat rules instruct the agent to periodically inspect sensitive personal data sources such as email, calendar, mentions, and weather context, then track checks in local state. Even if intended for helpfulness, this establishes ongoing background surveillance behavior that may exceed user expectations and expands the privacy attack surface if the agent or workspace is compromised.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
At this location, 'without asking' applies to proactive background work that includes checking projects and, in nearby lines, committing and pushing changes. In that context, the autonomy is dangerous because it can trigger external side effects and publish data without interactive user review.
- Content
md - Nothing new since last check - You just checked <60 minutes ago **Proactive work you can do without asking:** - Read and organize memory files - Check on projects (git status, etc.)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md → See **HOOKS.md § OnStop** for the full checklist. Short version: never mark done without checking actual output. "It should work" is not verification. "I confirmed it works" is. ### 📋 Task Complete → Always Run OnTaskComplete
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **Person B** spends 20 minutes in this session first. Their agent knows their name, their working style, what they're building, what it can act on without asking, and what it must never touch. It has a real mental model of them baked in from day one - not guessed, not pieced together from context clues, but told directly. The difference between Person A and Person B is this file.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **Person B** spends 20 minutes in this session first. Their agent knows their name, their working style, what they're building, what it can act on without asking, and what it must never touch. It has a real mental model of them baked in from day one - not guessed, not pieced together from context clues, but told directly. The difference between Person A and Person B is this file.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **Person B** spends 20 minutes in this session first. Their agent knows their name, their working style, what they're building, what it can act on without asking, and what it must never touch. It has a real mental model of them baked in from day one - not guessed, not pieced together from context clues, but told directly. The difference between Person A and Person B is this file.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **Person B** spends 20 minutes in this session first. Their agent knows their name, their working style, what they're building, what it can act on without asking, and what it must never touch. It has a real mental model of them baked in from day one - not guessed, not pieced together from context clues, but told directly. The difference between Person A and Person B is this file.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **Person B** spends 20 minutes in this session first. Their agent knows their name, their working style, what they're building, what it can act on without asking, and what it must never touch. It has a real mental model of them baked in from day one - not guessed, not pieced together from context clues, but told directly. The difference between Person A and Person B is this file.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrase 'I'm ready for the first session' is broad and immediately hands control to a long multi-step workflow without first presenting a scoped consent boundary. In practice, this can cause users to unknowingly initiate profiling, file inspection, and persistent memory writes simply by saying a natural-language phrase.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file tells the user to begin the session by speaking a phrase, but it does not clearly warn up front that the process will modify persistent files like USER.md, MEMORY.md, IDENTITY.md, and calibration-state.json. That omission undermines informed consent and increases the risk of collecting and storing sensitive personal data unexpectedly.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This section directs the agent to persist unanswered personal-profile questions in calibration-state.json and surface them across future sessions. Persisting user behavioral and availability data in plain language over time creates privacy risk, especially if the files are broadly accessible, synced, or retained without minimization.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The posture selector normalizes autonomous behavior, including reading files, web searching, memory updates, and drafting, before strong per-capability consent is established. In a skill that also profiles users and writes persistent memory, this increases the chance of over-collection, unintended external access, or actions exceeding user expectations.
- Content
md > > 🔒 **Conservative** - I check in before most actions. Lower cost, tighter security, good if you're new to running an agent or want maximum control. > > ⚖️ **Balanced** - Sensible defaults. I act on routine tasks without asking (reading files, searching the web, running memory updates, drafting content, summarizing), confirm before anything external or risky. Recommended for most people. > > 🚀 **Open** - More initiative, more autonomy, faster execution. For experienced users who want less friction. ⚠️ Review security defaults carefully before enabling this.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
This section instructs the agent to document what it can do 'on its own' and to copy hard limits into persistent files, reinforcing a durable autonomous policy that may later be applied out of context. The danger is not mere documentation, but establishing broad standing authorization that can be reused across sessions without fresh verification.
- Content
md > *"Based on [posture], here's what I can do on my own... here's what I'll always ask about first... and here's what I'll never do. Does that feel right? Anything to add or change?"* Write any personal additions into `AGENTS.md`. Copy the key hard limits to USER.md under "Never do without asking" so both files stay consistent. > **Why this matters:** An agent without clear permission tiers either asks about everything (annoying) or assumes too much (dangerous). Two minutes here prevents both.
Static analysis
No suspicious patterns detected.