Value Tracker

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:30 AM UTC
• Version: 0.1.0

Overview

This is a local value-tracking utility that writes task records to a local JSON file; it has a low-risk packaging issue because it ships with populated operational history.

Before installing, be aware that logged task descriptions and notes are stored locally in data.json and can be included in exports. Review or clear the bundled data.json and avoid logging sensitive business, customer, credential, or personal information unless you are comfortable retaining it locally.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: data.json:3

Finding

Plaintext Operational Metadata Distributed with the Skill

Content

View full analysis

Vulnerability Details

File Location: data.json, lines 3–256
Vulnerability Type: Plaintext sensitive operational data exposure
Risk Level: Low

Vulnerable Data

json

{
  "timestamp": "2026-01-26T22:05:08.819698",
  "date": "2026-01-26",
  "category": "tech",
  "task": "integration_setup",
  "hours": 2.0,
  "notes": "Toast API"
},
{
  "timestamp": "2026-01-26T22:05:08.888779",
  "date": "2026-01-26",
  "category": "tech",
  "task": "integration_setup",
  "hours": 1.5,
  "notes": "Microsoft Graph (Outlook)"
},
{
  "timestamp": "2026-01-26T22:05:09.081477",
  "date": "2026-01-26",
  "category": "tech",
  "task": "automation_created",
  "hours": 1.0,
  "notes": "Morning Briefing cron"
},
{
  "timestamp": "2026-01-26T22:05:09.244674",
  "date": "2026-01-26",
  "category": "research",
  "task": "competitive_analysis",
  "hours": 3.0,
  "notes": "Bulla Gastrobar deep dive"
},
{
  "timestamp": "2026-01-26T22:05:09.631587",
  "date": "2026-01-26",
  "category": "sales",
  "task": "pipeline_review",
  "hours": 0.5,
  "notes": "Pipedrive analysis"
}

Technical Analysis

The distributed data file contains 30 timestamped operational records in plaintext. These records disclose third-party integrations, scheduled automation names, business research subjects, communication tooling, sales systems, and project-related activities.

The records are not required for the application to function. The tracker can operate with an empty data structure such as {"entries": []}. Shipping runtime-generated operational history in the package therefore creates unnecessary information exposure.

No credentials, authentication tokens, or direct secrets were identified in the reviewed data. Exploitation requires access to the project directory, repository, release archive, backup, or another copy of the package.

Attack Path

1. An attacker obtains read a ...[truncated 1092 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the distributed file with a clean initial state:

   json

   {
     "entries": []
   }
   

2. Exclude runtime-generated data.json files from version control and release archives, while retaining a sanitized template such as data.example.json.

3. If demonstration records are necessary, use clearly synthetic organization names, timestamps, integrations, and activities.

4. Add a release-stage check that detects populated runtime data, credentials, tokens, personal information, and internal project names.

5. Store user-generated records in a user-specific application data directory rather than inside the installed Skill directory.

6. Restrict file permissions where records may contain confidential descriptions or notes.

7. Document data-retention, backup, sanitization, and deletion procedures for users.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · tracker.py (reported line 63)May include surrounding context.

python

return {"entries": []}

def save_data(data):
    """Save data to file."""
    with open(DATA_FILE, 'w') as f:
        json.dump(data, f, indent=2)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file documents that tasks are stored in data.json and can be exported as JSON for dashboards, which may include sensitive business details from task descriptions. While it notes backups, it does not warn users that logged content may persist locally and be exposed through exports or downstream tools.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.