T09 · Insecure Skill Coding Practices
Error
- Location
references/onboarding.md:49- Finding
Shell Command Injection Through Unsafely Interpolated User Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Wavye
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate Wayve integration, but it broadly reads, stores, and changes sensitive planning and business data with insufficient scoping and safeguards.
Review this carefully before installing. Only use it if you are comfortable giving the Wayve CLI access to read and change your planning data and to store long-term personal, schedule, health, family, coaching, and business context in your Wayve account. Prefer explicit confirmation before saving sensitive memories or creating automations, avoid pasting secrets into command lines, and consider pinning the CLI to a reviewed version.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:14- Finding
Mutable and Unverified npm CLI Dependency
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/automations.md:83- Finding
Notification Credentials Exposed Through Process Arguments and Plaintext Shell Handling
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:30- Finding
Overbroad Mandatory Collection and Server-Side Persistence of Sensitive User Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (42)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill description says to use the skill whenever users mention broad themes like planning, automations, business strategy, or getting more out of their agent, even without explicitly saying “Wayve.” That creates an over-broad trigger surface where ordinary conversation may invoke a tool-backed skill unexpectedly, causing unintended access to external systems and user data.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ### What NOT to Do - Don't be a financial advisor — you're a strategic thinking partner - Don't judge revenue levels — €2000/month and €20000/month are both valid - Don't push growth if the user is content with their current level - Don't track expenses, profit margins, or tax — that's outside Wayve's scope - Always respect if the user doesn't want to share financial details
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documented categories explicitly include sensitive medical conditions, family situation, relationship details, and detailed financial data, yet the skill metadata and workflow do not provide a strong upfront warning that such data may be persistently stored server-side. That omission is dangerous because users may disclose highly sensitive information in ordinary conversation without understanding the storage, retention, and cross-session reuse implications.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions direct the agent to save sensitive health, financial, family, and crisis-related information from normal conversations into persistent memory. Persistently storing these categories without strict necessity and explicit informed consent materially increases privacy, profiling, and potential compliance risks, especially if data is later reused or exposed.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow instructs the agent to create activities and set recurring habits without any confirmation step. Because this directly changes the user's planning system and can create ongoing recurring commitments, accidental or overbroad execution could materially disrupt schedules and trust in the assistant.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md User says "wrap up", "review my week", "how did my week go", or it's Sunday context. ## Your Approach Celebratory and learning-focused. Lead with "what worked?" not "what failed?" The goal is reflection without judgment — awareness, not guilt. ## Flow
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to persist essentially everything it learns and says every flow requires CLI-backed saving, with language like “persist everything you learn.” This creates excessive long-term retention of potentially sensitive personal, behavioral, scheduling, and business data without clear minimization, purpose limitation, or per-item consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The default
/wayvebehavior tells the agent to “use your judgment,” which leaves the scope of actions under-specified for a tool that can retrieve context, read long-term memory, and create or modify user data. Ambiguous default behavior increases the chance of over-collection, over-sharing, or performing operations the user did not clearly request.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill requires retrieving
wayve knowledge summaryat the start of every session and referencing a stored insight in the first substantive response. This unnecessarily exposes prior personal data in unrelated conversations and normalizes broad background access even when the user’s current request does not need it.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The continuous-learning section explicitly directs the agent to save personal context, financial data, corrections, and recurring patterns as part of ordinary conversation. In a coaching/productivity skill focused on life pillars, this context is especially sensitive because it can include health, mindset, relationships, finances, and behavioral trends, increasing privacy and profiling risk if over-retained or misused.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Telegram:
- Create a bot via @BotFather, get the bot token
- Start a chat with your bot, send a message
- Get your chat_id via
https://api.telegram.org/bot<TOKEN>/getUpdates - Pass via CLI:
bash wayve automations create morning_brief --cron "30 7 * * *" --timezone Europe/Amsterdam --channel telegram --delivery-config '{"bot_token":"YOUR_TOKEN","chat_id":"YOUR_CHAT_ID"}' --json
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The playbook directs the agent to observe, infer, and save personal behavioral themes across sessions without requiring a clear, prior consent flow or prominent privacy notice at the point of collection. In a coaching context, these inferred labels can become sensitive profiling data and may surprise users if retained persistently.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document explicitly instructs saving crisis-event details, what happened, and how the user coped for future recall across sessions. Life events such as illness, breakup, or family emergency are highly sensitive personal data; persisting them in plain-language notes materially raises privacy harm if exposed, misused, or retained longer than necessary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section instructs the agent to collect and save revenue, client count, pricing, and revenue targets, which are sensitive business data, but does not require a clear upfront privacy disclosure or explicit consent before persistence. Persistent storage of financial/business context increases confidentiality risk and may violate user expectations if handled implicitly during coaching.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section promotes ongoing collection and storage of personal and financial data in the knowledge base, including revenue, client count, targets, and pricing. Cross-session accumulation of sensitive business information creates a richer target for misuse or breach and increases the consequences of unauthorized access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation rule is overly broad because it triggers not only on explicit commands like 'fresh start' or 'plan my week' but also on vague phrases like 'let's plan' and any 'Monday context.' In an agent skill, ambiguous invocation can cause the skill to activate unexpectedly, leading to unintended access to personal planning context, memory, and scheduling actions that the user did not clearly request.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file frames the product's value around persistent memory that stores planning insights across devices, sessions, and AI clients, encouraging broad retention and reuse beyond narrow task necessity. This is risky because it normalizes accumulation of longitudinal user profiles that may exceed what is needed for the immediate interaction and expands the privacy blast radius if mishandled.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file mandates automatic retrieval and use of server-side stored personal knowledge at the start of every planning interaction, but does not require meaningful, session-time notice or consent before resurfacing prior personal data. This creates a privacy risk because highly personal context can be used unexpectedly across sessions and clients, increasing the chance of inappropriate disclosure, over-collection, or user surprise.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The 'During Any Conversation' section tells the agent to systematically harvest personal disclosures, frustrations, preferences, and repeated blockers for later storage. This is dangerous because it turns ordinary conversation into ongoing profile extraction without requiring contemporaneous notice, necessity checks, or user approval for each memory action.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### When to update vs. create new - **Update** when new data refines an existing insight (e.g., adding a 4th week of data to a trend) - **Create new** when it's a genuinely different insight in the same category - **Delete** — When you believe an insight is outdated or wrong, ask the user: 'This insight seems outdated — want me to update or remove it?' Only delete without asking when the user explicitly requests it ('forget that', 'delete that'). ---
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The end-of-session checklist and mandatory retrieval workflow encourage continual accumulation of user information and require resurfacing at least one stored insight in future sessions. This creates a compounding privacy risk by incentivizing the system to keep expanding the user's profile and to reuse it by default, even when not strictly needed for the current request.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are broad enough that a user asking for a general self-review could invoke this skill unintentionally. In this skill's context, unintended invocation is more concerning because the flow later instructs the agent to read extensive personal data and perform writes, so accidental activation can cascade into privacy-impacting and state-changing actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to save milestone observations to knowledge creates persistent records without telling the user or asking permission. This is dangerous because it silently transforms a conversational analysis into durable profiling, which can surprise users and retain sensitive personal inferences across sessions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Creating and resurfacing suggestions modifies stored planning data, yet the workflow does not warn the user that it will do so. In a coaching/planning skill, these writes can alter the user's task environment and future prompts, making the issue more than a cosmetic change.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Saving major patterns, delegation candidates, happiness correlations, and balance recommendations to knowledge persists sensitive behavioral inferences without disclosure. In this life-audit context, the data is especially intimate, so silent storage increases privacy risk and may influence future agent behavior in ways the user did not intend.
- Content
Static analysis
No suspicious patterns detected.