Security audit

Webtop Galim

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent with its school-task purpose, but it handles children's credentials, can write homework details into Google Calendar, and uses unsafe local configuration and external-script execution patterns that warrant review before installation.

Install only if you intend to store student portal credentials locally and allow this skill to log in to school systems. Treat the calendar sync as a write operation that can copy homework titles, due dates, subjects, and child names into Google Calendar. Avoid using WEBTOP_GALIM_ENV with untrusted files, protect the env and Google service-account files, and review the external Webtop dependency before running report commands.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/claude-code-wrapper.sh:29
Finding: Configurable Environment File Is Executed as Shell Code
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: scripts/webtop_fetch_summary.py:7
Finding: Unverified External Script Is Executed Outside the Audited Skill
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (45)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a read/check/summarize utility, but it also performs write actions to Google Calendar and uses external resources not clearly disclosed in the primary description. Hidden write-side effects are dangerous because users may invoke the skill expecting passive inspection while it modifies third-party systems and propagates children's school data beyond the original portals.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a read/check/summarize utility, but it also performs write actions to Google Calendar and uses external resources not clearly disclosed in the primary description. Hidden write-side effects are dangerous because users may invoke the skill expecting passive inspection while it modifies third-party systems and propagates children's school data beyond the original portals.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file repeatedly instructs the agent to summarize results in Hebrew, starting here, as a mandatory output requirement rather than an optional or user-selected preference. This is a natural-language locale policy issue because it constrains language output without documenting user opt-in or a justified region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This instruction requires the summary to be written in Hebrew for a parent, but does not offer a language choice or indicate that the user requested Hebrew. That makes the locale requirement a policy concern under the natural-language language-choice rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The prompt mandates a Hebrew summary format without any indication that the user opted into Hebrew output. Mandatory language constraints like this should either be optional or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This line directs the agent to build a Hebrew parent-friendly report without presenting Hebrew as a user-selected option. That creates a language policy issue because the skill enforces a specific locale by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction mandates Hebrew summaries by child but does not mention user preference or any justified locale restriction. This is a natural-language policy issue because it hardcodes output language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This line requires a short Hebrew summary of homework status with no opt-in or alternative language path. Enforcing a specific language in this way violates the language-choice policy criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest describes checking, monitoring, and summarizing homework/tasks across Webtop, Galim Pro, and Ofek, plus maintaining automations that send alerts about new tasks. The 'Calendar sync' prompt instructs running a sync operation and reporting what changed, which expands the skill from inspection/summarization into modifying or synchronizing an external calendar system not mentioned in the manifest description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prompt tells the agent to report sync results in Hebrew without indicating that Hebrew was selected by the user or justified by context. This is a locale-policy concern because the language is fixed rather than user-directed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill recommends running the calendar sync command without clearly warning that it performs write operations against an external calendar. An agent following this guidance could modify, create, or update calendar events without explicit user confirmation, which violates the principle of requiring consent before side-effecting actions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents capabilities that require environment access, file reads, network access, and shell execution, but it does not declare any explicit tool scope or permissions boundary. This increases the chance of over-privileged execution and makes it harder to enforce least privilege for a skill that also handles student credentials and external integrations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill framing emphasizes monitoring and summarization, but the documented automation also sends WhatsApp messages and creates calendar entries. This mismatch can cause unintended data sharing and action execution, especially because the data concerns children's homework and school activity.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The trigger language is broad enough that the skill could be invoked for generic school-related requests, causing unnecessary access to sensitive portals, credentials, and family data. Over-broad routing becomes more dangerous here because the skill has networked automation and outbound messaging/calendar side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation omits an explicit privacy warning even though it sends children's school data to WhatsApp and Google Calendar, both of which may involve third-party processing and broader audience exposure. This is dangerous because task details, schedules, and identifiers related to minors can be disclosed outside the original education systems without clear informed consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Creating Google Calendar events extends the skill from passive inspection into persistent modification of an external account, which is not clearly justified by the stated purpose. In context, this is more sensitive because it processes minors' school schedules and can expose due dates, subjects, and routines to another platform.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation instructs users to place student IDs and passwords in a plaintext .env file under a root-owned workspace path, but provides no guidance on file permissions, secret handling, rotation, or safer secret storage. Because these are credentials for student/school portals and the skill automates access across multiple children, exposure of this file could lead to unauthorized access to minors' educational data and account misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script sources an env file and exports multiple username and password variables, including child account credentials, but provides no confirmation prompt or warning that sensitive credentials will be loaded into the process environment. Because this wrapper also passes those variables to downstream commands, users are not explicitly alerted to the privacy-sensitive handling of secrets.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The wrapper exposes a sync command that executes sync_galim_calendar.py, extending the skill from passive homework inspection into a state-changing integration with an external calendar. In an agent setting, this increases risk because a user or upstream prompt can trigger writes to third-party systems not clearly covered by the skill’s stated purpose, enabling unintended data propagation or unauthorized calendar modifications.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/expanded_report.py (reported line 14)May include surrounding context.
python
def run_json(cmd): proc = subprocess.run(cmd, capture_output=True, text=True, timeout=300) if proc.returncode != 0: raise RuntimeError(proc.stderr or proc.stdout) return json.loads(proc.stdout)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script emits all user-facing report text in Hebrew string literals throughout the generated output, with no option to select another language or locale. This is a natural-language policy concern because it imposes a specific language on all users without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill reads student account credentials from local env files and from the process environment, including a caller-controlled WEBTOP_GALIM_ENV override. In an agent/skill setting, this expands the trust boundary to local secrets and arbitrary local files, which can expose credentials or cause the skill to operate on unintended accounts without clear user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script silently loads credentials for children from local configuration without any user-facing prompt, confirmation, or disclosure. In an automation/agent context, that can lead to unexpected use of sensitive student credentials and weakens informed consent and auditability around secret use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The code automates login to an external education portal and submits stored credentials without any explicit runtime notice to the user. In a skill ecosystem, silent credential submission to third-party services is risky because users may not realize when secrets are being used or where they are sent, especially for student accounts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Both service URLs force lang=he, and the rendered output is entirely in Hebrew. This imposes a specific language/locale without opt-in or explanation, which matches the policy category for language or locale violations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.