System Restoration

• Outcome: Review
• Latest audit: May 28, 2026 · 7:41 AM UTC
• Version: 1.0.0

Overview

This looks like a real restoration runbook, but it can re-enable persistent automations, change production scripts, point to a Slack token location, and includes a data-source helper that returns mock operational data.

Install only if you operate the exact Ranger/Advantage HPE macOS environment described. Before using it, verify all scripts and plist files, confirm Slack token scope and channel IDs, review any cron or LaunchD changes, and do not use the browser data-source helper in live reporting until it fetches verified real data or fails closed instead of returning mock records.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (24)

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The documentation reveals a concrete local filesystem path to a file that stores a Slack bot token, effectively advertising where sensitive credentials reside. Even though the token value is redacted, exposing the path lowers the effort needed for credential discovery or targeting, especially in a restoration skill that may already operate with elevated local access.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: These steps instruct the user to overwrite a production script from a backup and immediately reload a persistent service, but provide no warning about configuration drift, code provenance, rollback validation, or production side effects. In a restoration skill, that makes accidental deployment of stale or unsafe code more likely and can silently reintroduce broken logic or insecure behavior.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guide recommends replacing API access with browser automation without discussing credential storage, session handling, scraping of sensitive operational data, or privacy/compliance implications. Browser automation often expands the attack surface by requiring interactive credentials, cookies, local profiles, or broader data access than the original API.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs restarting a long-lived Slack bot in the background with '&' and only minimal verification, without warning about duplicate processes, orphaned jobs, log capture, credential exposure, or unintended message delivery. Backgrounding operational bots without supervision can create persistent uncontrolled behavior and make incident response harder.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The markdown instructs operators that Slack posting uses a local file containing the bot token but provides no warning or safeguards around secret handling. In practice, this normalizes direct credential access in reference material and increases the chance of accidental disclosure, misuse, or propagation into other tooling, logs, or prompts.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The checklist documents rollback steps that stop services, remove cron jobs, and kill processes, but it provides no warning, scoping guidance, or confirmation requirements before executing them. In an operational runbook, this can lead to accidental denial of service or over-broad disruption, especially because wildcard unloads and process-kill commands may affect multiple running automations at once.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# Load service (enable and start)
launchctl load ~/Library/LaunchAgents/com.ranger.SERVICENAME.plist

# Unload service (disable and stop)  
launchctl unload ~/Library/LaunchAgents/com.ranger.SERVICENAME.plist

• Confidence: 75% confidence
• Finding: This documentation explicitly instructs users to load a LaunchAgent with 'launchctl load', which enables persistent execution at login/session start. In an administrative restoration context this is likely legitimate, but if copied without review it can normalize or facilitate persistence mechanisms that attackers also abuse, especially because it uses a user-writable LaunchAgents path and placeholder service names.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# Load service (enable and start)
launchctl load ~/Library/LaunchAgents/com.ranger.SERVICENAME.plist

# Unload service (disable and stop)  
launchctl unload ~/Library/LaunchAgents/com.ranger.SERVICENAME.plist

• Confidence: 75% confidence
• Finding: This documentation explicitly instructs users to load a LaunchAgent with 'launchctl load', which enables persistent execution at login/session start. In an administrative restoration context this is likely legitimate, but if copied without review it can normalize or facilitate persistence mechanisms that attackers also abuse, especially because it uses a user-writable LaunchAgents path and placeholder service names.

Session Persistence

Medium

• Category: Rogue Agent

Content

#### ☐ Restoration Steps
- [ ] Test script: `python3 reconciliation_report.py --no-email`
- [ ] Create cron job for 7:00 AM CT daily
- [ ] Verify channel posting

#### ☐ Success Criteria

• Confidence: 84% confidence
• Finding: The instruction to create a daily cron job establishes persistent execution on the host, which is a recognized persistence mechanism. In a troubleshooting checklist this may be operationally intended, but from a security perspective it changes system state in a durable way and could be abused to maintain unauthorized code execution if the referenced script or schedule is compromised.

Session Persistence

Medium

• Category: Rogue Agent

Content

#### ☐ Restoration Steps
- [ ] Test script: `cd /Users/stephendobbins/.config/ranger/scripts && python3 margin_alerts.py`
- [ ] Load service: `launchctl load ~/Library/LaunchAgents/com.ranger.margin-alerts.plist`
- [ ] Verify posting: Check #margin-alerts for test alerts
- [ ] Check logs: `tail /tmp/margin_alerts.log`

• Confidence: 92% confidence
• Finding: Loading a LaunchD plist enables a persistent user agent that will continue running beyond the current session, which is a classic persistence mechanism. In this skill the action is framed as service restoration, but the context still makes it security-relevant because it authorizes durable execution of a local script without any approval, integrity, or ownership checks.

Session Persistence

Medium

• Category: Rogue Agent

Content

#### ☐ Restoration Steps
- [ ] Test script: `cd /Users/stephendobbins/.config/ranger/scripts && python3 margin_alerts.py`
- [ ] Load service: `launchctl load ~/Library/LaunchAgents/com.ranger.margin-alerts.plist`
- [ ] Verify posting: Check #margin-alerts for test alerts
- [ ] Check logs: `tail /tmp/margin_alerts.log`

• Confidence: 92% confidence
• Finding: Loading a LaunchD plist enables a persistent user agent that will continue running beyond the current session, which is a classic persistence mechanism. In this skill the action is framed as service restoration, but the context still makes it security-relevant because it authorizes durable execution of a local script without any approval, integrity, or ownership checks.

Session Persistence

Medium

• Category: Rogue Agent

Content

#### ☐ Restoration Steps
- [ ] Restore backup: `cp pulse_os_full.py.bak pulse_os_full.py`
- [ ] Fix data sources: Add browser automation imports
- [ ] Load service: `launchctl load ~/Library/LaunchAgents/com.ranger.morning-pulse.plist`
- [ ] Test: `python3 pulse_os_full.py pulse`
- [ ] Verify sections: Low margin, stale estimates, revenue leaks, driver incidents

• Confidence: 92% confidence
• Finding: The `launchctl load` instruction activates a persistent scheduled service for the morning pulse workflow. Even though the checklist is intended for legitimate restoration, persistent execution of a script that has just been restored or modified is risky without validation because compromised code would automatically run on schedule.

Session Persistence

Medium

• Category: Rogue Agent

Content

#### ☐ Restoration Steps
- [ ] Restore backup: `cp pulse_os_full.py.bak pulse_os_full.py`
- [ ] Fix data sources: Add browser automation imports
- [ ] Load service: `launchctl load ~/Library/LaunchAgents/com.ranger.morning-pulse.plist`
- [ ] Test: `python3 pulse_os_full.py pulse`
- [ ] Verify sections: Low margin, stale estimates, revenue leaks, driver incidents

• Confidence: 92% confidence
• Finding: The `launchctl load` instruction activates a persistent scheduled service for the morning pulse workflow. Even though the checklist is intended for legitimate restoration, persistent execution of a script that has just been restored or modified is risky without validation because compromised code would automatically run on schedule.

Session Persistence

Medium

• Category: Rogue Agent

Content

- [ ] No existing LaunchD service (needs creation)

#### ☐ Service Creation
- [ ] Create plist: Use `scripts/create-live-nudges-service.py` 
- [ ] Load service: `launchctl load ~/Library/LaunchAgents/com.ranger.live-nudges.plist`
- [ ] Test function: `python3 pulse_os_full.py nudges`

• Confidence: 87% confidence
• Finding: The checklist instructs the user to create a new LaunchD plist for live nudges, which introduces a new persistent execution mechanism on the host. Creating persistence is expected in an automation runbook, but it remains security-sensitive because it expands attack surface and can permanently schedule compromised code if the generator script or plist content is unsafe.

Session Persistence

Medium

• Category: Rogue Agent

Content

#### ☐ Service Creation
- [ ] Create plist: Use `scripts/create-live-nudges-service.py` 
- [ ] Load service: `launchctl load ~/Library/LaunchAgents/com.ranger.live-nudges.plist`
- [ ] Test function: `python3 pulse_os_full.py nudges`

#### ☐ Success Criteria

• Confidence: 92% confidence
• Finding: Loading the newly created live-nudges plist activates a persistent background service that runs every 15 minutes. Because this is durable scheduled execution, it is a true persistence mechanism and could be abused if the underlying script, plist, or generation process were tampered with.

Session Persistence

Medium

• Category: Rogue Agent

Content

#### ☐ Service Creation
- [ ] Create plist: Use `scripts/create-live-nudges-service.py` 
- [ ] Load service: `launchctl load ~/Library/LaunchAgents/com.ranger.live-nudges.plist`
- [ ] Test function: `python3 pulse_os_full.py nudges`

#### ☐ Success Criteria

• Confidence: 92% confidence
• Finding: Loading the newly created live-nudges plist activates a persistent background service that runs every 15 minutes. Because this is durable scheduled execution, it is a true persistence mechanism and could be abused if the underlying script, plist, or generation process were tampered with.

Session Persistence

Medium

• Category: Rogue Agent

Content

import os
from pathlib import Path

PLIST_CONTENT = '''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>

• Confidence: 94% confidence
• Finding: The script embeds a LaunchD plist that establishes recurring execution of a user-level Python program every 900 seconds. Persistence mechanisms are security-sensitive because they create automatic code execution at login/session scope and can be abused if the referenced script or user environment is compromised.

Session Persistence

Medium

• Category: Rogue Agent

Content

from pathlib import Path

PLIST_CONTENT = '''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

• Confidence: 93% confidence
• Finding: The duplicated detection at this line still corresponds to the same core issue: authoring a LaunchD plist for autorun behavior. Persistence in user LaunchAgents is not inherently malicious, but it is a real security-relevant behavior that should be controlled and audited.

Session Persistence

Medium

• Category: Rogue Agent

Content

from pathlib import Path

PLIST_CONTENT = '''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

• Confidence: 93% confidence
• Finding: The duplicated detection at this line still corresponds to the same core issue: authoring a LaunchD plist for autorun behavior. Persistence in user LaunchAgents is not inherently malicious, but it is a real security-relevant behavior that should be controlled and audited.

Session Persistence

Medium

• Category: Rogue Agent

Content

PLIST_CONTENT = '''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.ranger.live-nudges</string>

• Confidence: 93% confidence
• Finding: The plist XML defines a launch agent label and subsequent autorun behavior, contributing to persistent scheduled execution. In the context of a system-restoration skill this may be operationally intended, but persistence remains dangerous if an attacker can modify the target script or trick an operator into installing it.

Session Persistence

Medium

• Category: Rogue Agent

Content

</plist>'''

def create_service():
    """Create LaunchD service plist for live nudges"""
    launch_agents_dir = Path.home() / "Library" / "LaunchAgents"
    launch_agents_dir.mkdir(exist_ok=True)

• Confidence: 96% confidence
• Finding: The function creates the user's ~/Library/LaunchAgents directory in preparation for writing a LaunchD agent, enabling persistence within the user session. Creating this path is part of establishing recurring execution and should be treated as a real security-sensitive action.

Session Persistence

Medium

• Category: Rogue Agent

Content

launch_agents_dir = Path.home() / "Library" / "LaunchAgents"
    launch_agents_dir.mkdir(exist_ok=True)
    
    plist_file = launch_agents_dir / "com.ranger.live-nudges.plist"
    
    with open(plist_file, 'w') as f:
        f.write(PLIST_CONTENT)

• Confidence: 96% confidence
• Finding: This duplicate hit on the same line reflects the same persistence concern: defining a LaunchAgent plist path in the user's home directory. The skill context makes it more understandable operationally, but not less security-relevant, because it still creates automatic future execution.

Session Persistence

Medium

• Category: Rogue Agent

Content

launch_agents_dir = Path.home() / "Library" / "LaunchAgents"
    launch_agents_dir.mkdir(exist_ok=True)
    
    plist_file = launch_agents_dir / "com.ranger.live-nudges.plist"
    
    with open(plist_file, 'w') as f:
        f.write(PLIST_CONTENT)

• Confidence: 96% confidence
• Finding: This duplicate hit on the same line reflects the same persistence concern: defining a LaunchAgent plist path in the user's home directory. The skill context makes it more understandable operationally, but not less security-relevant, because it still creates automatic future execution.

Session Persistence

Medium

• Category: Rogue Agent

Content

plist_file = launch_agents_dir / "com.ranger.live-nudges.plist"
    
    with open(plist_file, 'w') as f:
        f.write(PLIST_CONTENT)
    
    print(f"✅ Created {plist_file}")

• Confidence: 98% confidence
• Finding: The code writes the embedded plist content to disk, which is the concrete step that installs the persistence artifact. This is dangerous because it establishes a durable execution path for a Python script under the user's account, and the referenced script lives in a user config directory that may be easier to alter than a system-managed location.

Static analysis

No suspicious patterns detected.