Solo Workflow Engine Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a no-code automation guide, but it asks for shell execution permission and gives broad automation advice for live business workflows without tight safeguards.

Install only if you are comfortable granting this skill command-execution capability, or restrict it to read-only/no-shell use. Use test accounts and sample data before connecting CRM, payment, email, or social accounts, and avoid giving the agent secrets or broad production permissions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Excessive Command-Execution Permission in a Documentation-Only Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Excessive tool authorization and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: read exec

Technical Analysis

The skill requests the exec tool, which can permit operating-system command execution in agent platforms that enforce the allowed-tools declaration. The documented workflow primarily provides natural-language guidance for selecting, designing, and testing no-code automation services. The audited file does not contain an implementation that requires unrestricted local command execution.

Granting exec therefore expands the skill's authority beyond its demonstrated functional requirements. If user-controlled content, external service data, or later instructions influence tool invocation, the agent could be induced to execute arbitrary shell commands with the privileges of the hosting agent process.

The declaration does not itself execute a malicious command, and no embedded scripts or remote payloads were found. The vulnerability is the unnecessary exposure of a high-impact execution capability.

Attack Path

1. A platform loads SKILL.md and grants the tools declared by allowed-tools.
2. The skill receives attacker-controlled workflow requirements, application data, error messages, or copied configuration text.
3. The attacker embeds instructions directing the agent to diagnose or configure the workflow by running a crafted shell command.
4. Because exec is authorized, an insufficiently isolated agent may execute that command.
5. The command operates with the permissions and environmental access of the agent process.

Exploitation depends on the hosting platform honoring this declaration and on the agent accepting attacker-controlled instructions as a reason to invoke exec.

Impact Assessment

Successful exploitation could provide command execution wi ...[truncated 384 chars]

Remediation

View remediation

Remediation Suggestions

• Remove exec from allowed-tools and retain only the minimum tool set required by the documented behavior, such as read.
• If a specific diagnostic command is genuinely required, replace unrestricted execution with a narrowly scoped, parameterized diagnostic tool.
• Enforce an explicit command allowlist and reject shell metacharacters, command substitution, redirection, pipelines, and untrusted arguments.
• Require interactive approval before any local command is executed.
• Run approved commands in a sandbox with a read-only project filesystem, minimal environment variables, no credential mounts, restricted network access, and an unprivileged operating-system account.
• Treat workflow descriptions, copied error messages, and external application data as untrusted content that cannot authorize tool use.
• Add automated policy checks that flag documentation-only skills requesting command-execution capabilities.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest overstates the skill as supporting the full seven-step workflow lifecycle, including maintenance, while the content only implements the first four steps. Overbroad capability claims are dangerous in agent ecosystems because routing and user trust may cause the skill to be invoked for higher-risk operational tasks it does not safely define.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest claims maintenance coverage while the body says the free version excludes maintenance/monitoring. This inconsistency can mislead users and agents about the skill's authority and expected behaviors, increasing the chance that an agent improvises unsupported maintenance actions on live automations or data flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill encourages connecting third-party services and automating CRM, invoicing, email, and social workflows, but it does not warn about privacy, consent, credential handling, or integrity risks for customer data. In this context, missing safeguards are significant because users may automate live personal or financial data flows and rely on the agent's guidance without understanding security and compliance implications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The scope description is broad and ambiguous, including fragmented keywords and mixed triggers that could cause the agent to apply the skill outside its intended no-code workflow-advice context. Ambiguous activation criteria increase prompt-routing risk and can lead to inappropriate guidance or actions on real systems and data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is presented as a no-code workflow guidance asset, yet it explicitly declares exec capability and references running network diagnostic commands. That expands the agent's execution surface beyond the documented purpose, creating a mismatch that could let prompts or future edits steer the agent into unnecessary shell actions on the host system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file explicitly states that the content has been '完全中文化全部内容' and the skill description and examples are entirely Chinese, but there is no opt-in choice for language or explanation that the skill is intentionally region-specific. This can conflict with a language/locale policy requiring user choice unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.