T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:34- Finding
Unnecessary Arbitrary Command-Execution Permission
- Content
View full analysis
- Remediation
View remediation
Security audit
Macro Monitor
Security checks for vulnerabilities and agentic risk
Overview
The skill’s macro-news monitoring purpose is clear, but it asks for broad command execution and scheduled push behavior without a well-scoped need for that authority.
Install only if you are comfortable with a daily automated agent browsing third-party financial sites and sending summaries. The skill should ideally remove exec, use a package-relative knowledge file, require explicit opt-in for the cron job, and use a unique command-style trigger before running.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description claims risky code was removed and safety improved, but the manifest still exposes broad
execcapability. This mismatch can mislead reviewers and users into underestimating the skill's privileges, increasing the chance that dangerous execution rights are approved without adequate scrutiny.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The listed trigger keywords include generic terms like
monitor,trading, andfred, which are common in normal user conversations. This raises the risk of accidental skill activation, causing the agent to browse external resources and act outside the user's immediate intent.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill declares an
execcapability even though the documented workflow only needs reading, browser access, and message delivery. This creates unnecessary command-execution authority, so if the skill is triggered unexpectedly or later modified through prompt/content injection, the agent could run arbitrary shell commands on the host.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill's user-facing description does not clearly warn that it will automatically browse third-party financial websites and push collected results. Lack of clear disclosure weakens informed consent and makes accidental data access or outbound actions more likely, especially in scheduled or ambient agent environments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manual trigger phrase is a natural-language instruction broad enough to be invoked accidentally during ordinary conversation or by untrusted content. Because the skill performs autonomous browsing and push behavior, ambiguous activation can cause unintended external access and unsolicited message delivery.
- Content
Static analysis
No suspicious patterns detected.