Security audit

System Restoration

Security checks for vulnerabilities and agentic risk

Overview

This skill can re-enable scheduled business automations and Slack posting, and one included data-source script may publish fixed mock records as if they were live data.

Review before installing. Only use this skill if you control the named macOS account and business systems, and require explicit approval before overwriting scripts, creating cron jobs, or loading LaunchAgents. Verify every plist target, script ownership, permissions, and expected hash before enabling scheduled execution. Do not deploy the mock browser data-source functions into production reporting, and treat the Slack token location as sensitive secret material.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

Location: scripts/create-live-nudges-service.py:10
Finding: Persistent LaunchAgent Executes an External Mutable Script
Content: View full analysis
Label com.ranger.live-nudges ProgramArguments /Library/Frameworks/Python.framework/Versions/3.12/bin/python3 /Users/stephendobbins/.config/ranger/scripts/pulse_os_full.py nudges WorkingDirectory /Users/stephendobbins/.config/ranger/scripts StartInterval 900 StandardOutPath /tmp/live_nudges.log StandardErrorPath /tmp/live_nudges.err EnvironmentVariables PATH /opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin ''' def create_service(): """Create LaunchD service plist for live nudges""" launch_agents_dir = Path.home() / "Library" / "LaunchAgents" launch_agents_dir.mkdir(exist_ok=True) plist_file = launch_agents_dir / "com.ranger.live-nudges.plist" with open(plist_file, 'w') as f: f.write(PLIST_CONTENT) print(f"✅ Created {plist_file}") print("\nTo activate:") print(f"launchctl load {plist_file}") ``` Related instructions load additional persistent services: ```bash launchctl load /Users/stephendobbins/Library/LaunchAgents/com.ranger.margin ...[truncated 2325 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/browser_data_sources.py:17
Finding: Hardcoded Mock Operational Records Can Be Published as Live Data
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (60)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description is about operational recovery of HPE intelligence systems—service restoration, scheduler fixes, API remediation, and bringing business alerts/reports back online. The supplied code does none of that. It is a data-source stub for Morning Pulse that returns hardcoded sample records and includes a placeholder for future browser automation to replace broken ServiceTitan API calls. While it loosely relates to one declared area (Morning Pulse/data source issues), its actual behavior is materially narrower and different: mock data generation rather than system restoration. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill provides instructions that would modify files, create/load LaunchD jobs, and alter cron scheduling, yet it declares no explicit tool scope or permissions boundary. That increases the chance an agent could perform state-changing actions without clear user consent or runtime restriction, especially because the document is framed as an operational restoration runbook.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide instructs users to overwrite files from backups and load persistent services without any warning that these actions change system state and may re-enable broken or unsafe automation. In an agent setting, those steps could be executed prematurely, causing service persistence, rollback to unreviewed code, or restoration of compromised jobs.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 97% confidence
Finding: Loading a LaunchD plist creates or restores persistent scheduled execution, which can repeatedly run code without further user interaction. If the referenced script is incorrect, compromised, or points to mutable paths, this can reintroduce unsafe behavior every time the agent or system restarts.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
**Restoration Steps:** 1. Verify script exists and posts to Slack 2. Load LaunchD service: `launchctl load /Users/stephendobbins/Library/LaunchAgents/com.ranger.margin-alerts.plist` 3. Test manually: `cd /Users/stephendobbins/.config/ranger/scripts && python3 margin_alerts.py` 4. Check logs: `tail /tmp/margin_alerts.log`

Session Persistence

Medium

Category: Rogue Agent
Confidence: 97% confidence
Finding: Loading a LaunchD plist creates or restores persistent scheduled execution, which can repeatedly run code without further user interaction. If the referenced script is incorrect, compromised, or points to mutable paths, this can reintroduce unsafe behavior every time the agent or system restarts.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
**Restoration Steps:** 1. Verify script exists and posts to Slack 2. Load LaunchD service: `launchctl load /Users/stephendobbins/Library/LaunchAgents/com.ranger.margin-alerts.plist` 3. Test manually: `cd /Users/stephendobbins/.config/ranger/scripts && python3 margin_alerts.py` 4. Check logs: `tail /tmp/margin_alerts.log`

Session Persistence

Medium

Category: Rogue Agent
Confidence: 97% confidence
Finding: The guide instructs loading the morning-pulse LaunchD service after restoring or modifying the script, which establishes persistent execution of code that may not have been fully reviewed. Combining file replacement and immediate persistence increases the risk of reactivating flawed or malicious logic on a schedule.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
1. **If broken API data:** Check for `.bak` backup with working data sources 2. **Restore backup:** `cp pulse_os_full.py.bak pulse_os_full.py` 3. **Fix data sources:** Replace API calls with browser automation (see references/browser-data-sources.md) 4. Load LaunchD service: `launchctl load /Users/stephendobbins/Library/LaunchAgents/com.ranger.morning-pulse.plist` 5. Test: `python3 pulse_os_full.py pulse` ### Live Nudges

Session Persistence

Medium

Category: Rogue Agent
Confidence: 97% confidence
Finding: The guide instructs loading the morning-pulse LaunchD service after restoring or modifying the script, which establishes persistent execution of code that may not have been fully reviewed. Combining file replacement and immediate persistence increases the risk of reactivating flawed or malicious logic on a schedule.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
1. **If broken API data:** Check for `.bak` backup with working data sources 2. **Restore backup:** `cp pulse_os_full.py.bak pulse_os_full.py` 3. **Fix data sources:** Replace API calls with browser automation (see references/browser-data-sources.md) 4. Load LaunchD service: `launchctl load /Users/stephendobbins/Library/LaunchAgents/com.ranger.morning-pulse.plist` 5. Test: `python3 pulse_os_full.py pulse` ### Live Nudges

Session Persistence

Medium

Category: Rogue Agent
Confidence: 96% confidence
Finding: The skill instructs creation of a LaunchD service for live nudges, which establishes persistence on the host and causes code to run automatically on a schedule. Persistence mechanisms are security-sensitive because they can silently survive restarts and repeatedly execute buggy, unauthorized, or tampered scripts.
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
md
**Restoration Steps:** 1. Verify function exists: `grep -n "def run_nudges" pulse_os_full.py` 2. Create LaunchD service (see scripts/create-live-nudges-service.py) 3. Load service: `launchctl load /Users/stephendobbins/Library/LaunchAgents/com.ranger.live-nudges.plist` 4. Test: `python3 pulse_os_full.py nudges`

Session Persistence

Medium

Category: Rogue Agent
Confidence: 97% confidence
Finding: This command loads a LaunchD service for live nudges, enabling scheduled background execution and persistence across sessions. In the context of an agent skill, that is more dangerous than a normal document because it operationalizes unattended recurring actions tied to business communications.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
**Restoration Steps:** 1. Verify function exists: `grep -n "def run_nudges" pulse_os_full.py` 2. Create LaunchD service (see scripts/create-live-nudges-service.py) 3. Load service: `launchctl load /Users/stephendobbins/Library/LaunchAgents/com.ranger.live-nudges.plist` 4. Test: `python3 pulse_os_full.py nudges` ### Material Truth Report

Session Persistence

Medium

Category: Rogue Agent
Confidence: 97% confidence
Finding: This command loads a LaunchD service for live nudges, enabling scheduled background execution and persistence across sessions. In the context of an agent skill, that is more dangerous than a normal document because it operationalizes unattended recurring actions tied to business communications.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
**Restoration Steps:** 1. Verify function exists: `grep -n "def run_nudges" pulse_os_full.py` 2. Create LaunchD service (see scripts/create-live-nudges-service.py) 3. Load service: `launchctl load /Users/stephendobbins/Library/LaunchAgents/com.ranger.live-nudges.plist` 4. Test: `python3 pulse_os_full.py nudges` ### Material Truth Report

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Replacing API calls with browser automation can introduce credential capture, session-token exposure, scraping of sensitive operational data, and bypass of normal access controls, yet the guide provides no privacy, secrets-handling, or authorization safeguards. Because these systems appear to post business intelligence into Slack, compromised browser automation could leak sensitive internal data at scale.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 96% confidence
Finding: The generic service-management section includes a reusable command template for loading LaunchD services, which enables persistence and scheduled execution. Even as documentation, providing direct copy-pastable persistence commands without guardrails is risky in an autonomous or semi-autonomous agent context.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
launchctl list | grep ranger # Load service launchctl load /Users/stephendobbins/Library/LaunchAgents/com.ranger.<service>.plist # Unload service launchctl unload /Users/stephendobbins/Library/LaunchAgents/com.ranger.<service>.plist

Session Persistence

Medium

Category: Rogue Agent
Confidence: 96% confidence
Finding: The generic service-management section includes a reusable command template for loading LaunchD services, which enables persistence and scheduled execution. Even as documentation, providing direct copy-pastable persistence commands without guardrails is risky in an autonomous or semi-autonomous agent context.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
launchctl list | grep ranger # Load service launchctl load /Users/stephendobbins/Library/LaunchAgents/com.ranger.<service>.plist # Unload service launchctl unload /Users/stephendobbins/Library/LaunchAgents/com.ranger.<service>.plist

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file explicitly documents a local path to a configuration file that contains a Slack bot token, exposing where sensitive credentials can be retrieved. In a restoration skill, naming the exact credential source is broader than necessary operational guidance and increases the chance an agent or user accesses secrets unnecessarily.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/launchd-service-templates.md (reported line 7)May include surrounding context.
xml
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/launchd-service-templates.md (reported line 43)May include surrounding context.
xml
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/create-live-nudges-service.py (reported line 46)May include surrounding context.
python
```xml <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: Loading a LaunchAgent plist enables recurring execution and therefore creates or re-enables persistence on the system. In this skill context, that is part of service restoration, but from a security standpoint it still establishes a durable execution path that could be abused if the plist or referenced script is unsafe or tampered with.
Content: Scanner excerpt · references/troubleshooting-checklist.md (reported line 43)May include surrounding context.
md
#### ☐ Restoration Steps - [ ] Test script: `cd /Users/stephendobbins/.config/ranger/scripts && python3 margin_alerts.py` - [ ] Load service: `launchctl load ~/Library/LaunchAgents/com.ranger.margin-alerts.plist` - [ ] Verify posting: Check #margin-alerts for test alerts - [ ] Check logs: `tail /tmp/margin_alerts.log`

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: Loading a LaunchAgent plist enables recurring execution and therefore creates or re-enables persistence on the system. In this skill context, that is part of service restoration, but from a security standpoint it still establishes a durable execution path that could be abused if the plist or referenced script is unsafe or tampered with.
Content: Scanner excerpt · references/troubleshooting-checklist.md (reported line 43)May include surrounding context.
md
#### ☐ Restoration Steps - [ ] Test script: `cd /Users/stephendobbins/.config/ranger/scripts && python3 margin_alerts.py` - [ ] Load service: `launchctl load ~/Library/LaunchAgents/com.ranger.margin-alerts.plist` - [ ] Verify posting: Check #margin-alerts for test alerts - [ ] Check logs: `tail /tmp/margin_alerts.log`

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The command to load the morning-pulse LaunchAgent re-establishes scheduled execution, which is a persistence mechanism. Although appropriate for service recovery, it becomes dangerous if operators do not validate the restored backup and plist contents, since compromised or outdated code would then run automatically.
Content: Scanner excerpt · references/troubleshooting-checklist.md (reported line 70)May include surrounding context.
md
#### ☐ Restoration Steps - [ ] Restore backup: `cp pulse_os_full.py.bak pulse_os_full.py` - [ ] Fix data sources: Add browser automation imports - [ ] Load service: `launchctl load ~/Library/LaunchAgents/com.ranger.morning-pulse.plist` - [ ] Test: `python3 pulse_os_full.py pulse` - [ ] Verify sections: Low margin, stale estimates, revenue leaks, driver incidents

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The command to load the morning-pulse LaunchAgent re-establishes scheduled execution, which is a persistence mechanism. Although appropriate for service recovery, it becomes dangerous if operators do not validate the restored backup and plist contents, since compromised or outdated code would then run automatically.
Content: Scanner excerpt · references/troubleshooting-checklist.md (reported line 70)May include surrounding context.
md
#### ☐ Restoration Steps - [ ] Restore backup: `cp pulse_os_full.py.bak pulse_os_full.py` - [ ] Fix data sources: Add browser automation imports - [ ] Load service: `launchctl load ~/Library/LaunchAgents/com.ranger.morning-pulse.plist` - [ ] Test: `python3 pulse_os_full.py pulse` - [ ] Verify sections: Low margin, stale estimates, revenue leaks, driver incidents

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: Creating a new plist for a LaunchD service introduces a new persistence mechanism that will execute on a schedule. In an agent skill, generating persistence artifacts is more sensitive because it may be followed mechanically without sufficient review of the command, target script, or runtime privileges.
Content: Scanner excerpt · references/troubleshooting-checklist.md (reported line 90)May include surrounding context.
md
- [ ] No existing LaunchD service (needs creation) #### ☐ Service Creation - [ ] Create plist: Use `scripts/create-live-nudges-service.py` - [ ] Load service: `launchctl load ~/Library/LaunchAgents/com.ranger.live-nudges.plist` - [ ] Test function: `python3 pulse_os_full.py nudges`

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: Loading the live-nudges LaunchAgent activates scheduled persistence. This is operationally intended, but it still creates a durable execution path that could be exploited if the newly created plist or target script contains unsafe behavior or is later modified.
Content: Scanner excerpt · references/troubleshooting-checklist.md (reported line 91)May include surrounding context.
md
#### ☐ Service Creation - [ ] Create plist: Use `scripts/create-live-nudges-service.py` - [ ] Load service: `launchctl load ~/Library/LaunchAgents/com.ranger.live-nudges.plist` - [ ] Test function: `python3 pulse_os_full.py nudges` #### ☐ Success Criteria

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: Loading the live-nudges LaunchAgent activates scheduled persistence. This is operationally intended, but it still creates a durable execution path that could be exploited if the newly created plist or target script contains unsafe behavior or is later modified.
Content: Scanner excerpt · references/troubleshooting-checklist.md (reported line 91)May include surrounding context.
md
#### ☐ Service Creation - [ ] Create plist: Use `scripts/create-live-nudges-service.py` - [ ] Load service: `launchctl load ~/Library/LaunchAgents/com.ranger.live-nudges.plist` - [ ] Test function: `python3 pulse_os_full.py nudges` #### ☐ Success Criteria

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The instruction to create a daily cron job establishes persistence on the host by scheduling recurring execution. While operationally intended, persistence mechanisms are security-relevant because they can be abused to maintain unauthorized code execution or survive cleanup if the referenced script is modified or replaced.
Content: Scanner excerpt · references/troubleshooting-checklist.md (reported line 109)May include surrounding context.
md
#### ☐ Restoration Steps - [ ] Test script: `python3 reconciliation_report.py --no-email` - [ ] Create cron job for 7:00 AM CT daily - [ ] Verify channel posting #### ☐ Success Criteria