Security audit

feel good productivity + atom habits

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed local productivity system, but its migration instructions can reorganize or delete user notes without enough safeguards.

Install only if you want a persistent plaintext productivity system under ~/productivity/. Before any migration, make a backup, review the exact file moves, and do not let the agent delete old goals/projects/tasks/someday directories until you have verified the new files and explicitly approve cleanup.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: migration.md:81
Finding: Contradictory migration procedure can cause destructive loss or duplication of user data
Content: View full analysis
Vulnerability Details

File Location: migration.md, lines 81–92
Vulnerability Type: Unsafe and internally contradictory filesystem migration
Risk Level: Medium

Vulnerable Code Snippet

The following is a faithful English rendering of the affected migration instructions:

markdown
2. Migrate files: - `someday/ideas.md` → `commitments/0_dream/ideas.md` - `goals/active.md` → `commitments/1_intent/active.md` - `projects/active.md` → `commitments/2_queued/active.md` - `tasks/next-actions.md` → `commitments/3_committed/next-actions.md` - `tasks/this-week.md` → `commitments/3_committed/this-week.md` - `tasks/waiting.md` → `commitments/3_committed/waiting.md` - `tasks/done.md` → `commitments/4_done/achievements.md` - `projects/waiting.md` → `commitments/5_archived/waiting-projects.md` - `tasks/waiting.md` → `commitments/5_archived/waiting-tasks.md` (merge if it already exists) 3. Delete the old directories: `goals/`, `projects/`, `tasks/`, and `someday/`

The post-migration checklist at migration.md:226-230 also contains conflicting requirements:

markdown
- No legacy file was deleted without explicit user approval. - `goals/someday.md`, `planning/`, and `reviews/` are fully removed.

Technical Analysis

The migration maps the same source file, tasks/waiting.md, to two different destinations. A move operation cannot safely satisfy both mappings unless the source is first copied or its contents are parsed and deterministically divided. The guide does not define such a procedure.

The instructions then direct the agent to delete all legacy directories without requiring:

A timestamped backup

Destination collision detection

A defined merge algorithm

Verification that every source item reached its intended destination

Explicit confirmation immediately before deletion

A rollback procedure

This conflicts with the safeguards in ` ...[truncated 2013 chars]
Remediation: View remediation
Remediation Suggestions

Replace the ambiguous dual mapping with a deterministic operation:

Copy tasks/waiting.md to a temporary staging file.

Parse or merge its entries into both destinations according to documented classification rules.

Preserve source identifiers to prevent duplicates.

Require a timestamped backup before migration, for example:

text
~/productivity-backup-YYYYMMDD-HHMMSS/

Add destination safety checks:

Detect whether each destination already exists.

Never overwrite an existing file implicitly.

Use an item-level merge with duplicate detection.

Record merge conflicts for user review.

Add migration verification:

Compare source and destination item counts.

Confirm that every source entry has a destination.

Validate that expected files and directories exist.

Produce a migration summary before cleanup.

Separate migration from deletion:

Complete and verify all copy or merge operations first.

Keep legacy directories in a clearly marked backup state.

Request explicit user confirmation immediately before deleting them.

Define a rollback process that restores the backup if verification fails.

Reconcile the contradictory instructions in migration.md and SKILL.md so that all sections consistently prohibit automatic legacy deletion before verification and explicit approval.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · memory-template.md (reported line 15)May include surrounding context.
md
integration: pending ## Constraints   ## Work Style

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad and include generic requests like planning, breaking down tasks, and project help, which can cause the skill to activate for many normal conversations beyond the user’s intended scope. Over-broad activation increases the chance of unintended routing into this skill, potentially causing inappropriate file-writing suggestions, workflow steering, or collection of personal productivity information in contexts where a narrower skill should apply.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The statement that all productivity and personal development work should route through PD creates an overly expansive activation scope and encourages monopolizing adjacent intents. This can suppress safer or more appropriate skill selection, causing the agent to over-apply this framework to broad categories of user requests and increasing the chance of unnecessary access to sensitive personal planning context.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.
md
## Quick Queries | User says | Action | | ------------------------------- | -------------------------------------------------------------------------------------- | | "Set up my productivity system" | Create the `~/productivity/` baseline and explain the folders | | "What should I focus on?" | Check dashboard + tasks + commitments + focus, then surface top priorities |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This document provides mental-health-adjacent guidance about burnout prevention and recovery, including advice on rest, sleep, disclosure, and rebuilding activity, but it does not warn that the content is not medical advice or that severe burnout, depression, or crisis situations may require professional help. A user with serious symptoms could over-rely on self-help steps and delay seeking appropriate care, which increases the risk of harm.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The phrase "These apply across ALL situations" is extremely broad for a markdown skill file and does not define when these frameworks should or should not be invoked. Because it lacks scope limits or exclusion conditions, it could cause the skill to be pulled into many ordinary contexts unintentionally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file presents all user-facing instructional content in Chinese and does not provide any opt-in, alternative language, or justification for a Chinese-only locale. Under the natural-language policy rules, forcing a specific language without user choice is a policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The migration steps instruct users to delete old directories after moving data, but they do not explicitly require backups, verification, or confirmation before destructive operations. In a personal productivity skill, this increases the risk of accidental user data loss during manual migration, especially if files were only partially moved or merged incorrectly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: These later migration sections again direct users to delete files and directories without a clear safety warning, backup step, or post-move validation procedure. Because the skill manages user-authored notes and reviews, mistaken deletion could permanently destroy personal records and planning data.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The legacy migration section explicitly states 'Do not delete or rename them automatically' and 'Only clean up legacy files after the user confirms the new structure is working' (L218-L220). However, the later post-migration checklist says deprecated items such as goals/someday.md, planning/, and reviews/ should be 'fully removed' (L230), which contradicts the earlier safety guidance about preserving legacy files until explicit approval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs the agent to create and populate ~/productivity/ in the user's home directory, which is a persistent filesystem modification. Even though it says 'If yes', there is no explicit safety warning, dry-run, or confirmation of the exact paths and files to be created, so a user may not fully understand the scope of the changes before they occur.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file includes Chinese-only headings and explanatory text such as 文件夹结构 and other Chinese guidance while the surrounding document is primarily in English. This imposes a language/locale assumption without user opt-in or justification, which can violate organizational language policy for skills intended for general use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file is written entirely in Chinese and does not indicate that language is optional, user-selectable, or required for a specific region or compliance context. Under the policy for natural-language violations, forcing a specific language without opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file is largely written in Chinese but prominently uses English terms and headings such as "Feel-Good Productivity" without any note about intended audience or language preference. Under the language/locale policy rule, forcing a specific language mix without user opt-in can be a natural-language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown guidance is written as a bilingual/mixed-language document, with core instructions, labels, and examples alternating between Chinese and English. Under the policy rule for language/locale, forcing a specific language style without user opt-in can be a natural-language policy issue when no choice or justification is provided.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs creating a file under the user's home directory, which is a local filesystem modification. Even though the content is a harmless template, doing so without an explicit user-facing disclosure or consent pattern can lead to unintended local state changes and privacy concerns because the file is meant to store personal routines and constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document begins with Chinese-only section headings and change descriptions, while later sections switch to English. This imposes a language experience on users without opt-in or justification, which matches the language/locale policy concern for natural-language content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown template presents core usage guidance in Chinese while other sections are in English, but it does not state that the template is intended only for Chinese-speaking users or offer a language choice. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains end-user instructional content exclusively in Chinese, and there is no statement that the skill is intended only for Chinese-speaking users or that language selection is optional. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code Snippet

Technical Analysis

Remediation Suggestions

SkillSpector

Hidden Instructions

Vague Triggers

Vague Triggers

Whitespace Padding

Missing User Warnings

Vague Triggers

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis