Security audit

Setup Client Workspace (TNCG)

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent client-workspace setup playbook, but it grants broad messaging, cross-agent visibility, shared secrets, and production-facing authority that need review before use.

Install only in a trusted admin environment after reviewing and tightening the configuration. Replace wildcard WhatsApp sending with recipient allowlists, avoid legacy Git token-in-URL guidance, keep secrets out of workspace files, scope shared sandbox credentials per client where possible, document client consent for WhatsApp and escalation, and define revocation/retention steps for credentials, sessions, memory files, and cron jobs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The document instructs operators to embed a GitHub token directly in the remote URL, which stores a reusable secret in `.git/config` in plaintext. That contradicts the stated no-cleartext-secrets rule and creates a high risk of credential exposure through local file access, backups, accidental disclosure, or downstream tooling that prints remotes.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The security section says secrets must not be kept in cleartext, then explicitly allows API tokens in workspace files, which are readable by the agent and potentially copied, logged, or exposed through tooling. In this skill's context, workspaces are persistent client environments, so placing secrets there materially increases the blast radius if the agent or workspace is compromised.

Missing User Warnings

High

Confidence: 97% confidence
Finding: Beyond the cleartext secret issue, this section enables direct authenticated push from the agent-managed environment without strong warnings about credential leakage and repository integrity risk. In context, the skill also grants networked sandbox access and site bind mounts, so compromised agent behavior could immediately alter production content or exfiltrate credentials.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The workflow explicitly instructs operators to collect a client's WhatsApp number and a dedicated OpenAI API key, both of which are sensitive data, but provides no handling, storage, masking, retention, or consent guidance. In a setup skill for real client workspaces, this omission materially increases the chance of credential leakage, privacy violations, and accidental reuse of sensitive data across agents or logs.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The escalation note states that the skill can wake a supervisor through a webhook gateway and deliver to Erwan's Telegram by default, but does not warn that client-derived content may be transmitted to an external supervisory channel. That creates a real confidentiality and data-flow risk because operators may enable escalation without understanding that messages can leave the client's primary workspace context.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The WhatsApp configuration sets dmPolicy to allowlist for inbound messages but also sets allowSendTo to ["*"], which authorizes outbound messaging to any destination from the client's account. In this skill context, that is more dangerous because it provisions a live client communications channel, so a misconfigured or compromised agent could send unintended or harmful messages broadly.

Static analysis

No suspicious patterns detected.