Long Project Manager

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:54 AM UTC
• Version: 1.0.0

Overview

This skill openly creates local project note files so long-running work can be resumed later, with no hidden code, network access, or background persistence found.

Install only if you want the agent to keep durable local project notes. Review the project folder path and avoid writing secrets or sensitive business details into the generated markdown files unless that local storage is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The description says to use the skill when the user wants to 'start a long-term project,' 'continue a previous project,' or for broad domains like engineering, research, writing, planning, and operations work. These conditions are wide-ranging and lack explicit boundaries or negative examples, increasing the chance of unintended invocation for ordinary project-related requests.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Start a long project

When the user asks to create a long-running project or preserve context across sessions:

1. Normalize a short hyphen-case project name.
2. Create `projects/<name>/`.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill directs the agent to create and continuously modify files in the workspace without explicitly requiring confirmation or warning the user before durable changes are made. In practice, this can lead to unexpected filesystem writes, accidental overwrites, or persistent storage of sensitive content the user did not intend to keep.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The markdown template headings and prompts are entirely in Chinese, which imposes a specific language on skill users without offering an opt-in or alternative locale. This matches the policy category for language/locale constraints because the file provides no indication that the skill is region-specific or that another language is supported.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: This markdown file explains that the skill turns work into durable project state on disk, which implies file creation and ongoing file writes. Under the markdown criteria for SQP-2, the description should include a clear user warning about modifying local files or project data, but no such warning appears.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The workflow instructs the agent to choose between a Chinese template and an English template, but it does not say to ask the user which language they want or otherwise obtain opt-in. Because language/locale constraints should be user-driven unless clearly justified, this is a natural-language policy issue.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The file path and content indicate an English-only project template, and the instructions require specific English-named files such as `STATUS.md`, `TODO.md`, and `HANDOFF.md`. This imposes a language convention without any user opt-in or documented justification, which matches the language/locale policy concern for natural-language content.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The template headings and field labels are entirely in Chinese, which implicitly enforces a specific language for entries. There is no surrounding note offering a language choice or explaining that the template is intended only for a Chinese-speaking or region-specific context.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The natural-language content of this handoff template is entirely in Chinese, including the core operating instructions for resuming work. Because the file does not offer a language choice or explain a justified locale constraint, it can violate the policy against forcing a specific language without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: This log template uses Chinese section headings exclusively, which imposes a specific language on users. There is no indication that the language choice is optional or justified by a region-specific requirement.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The template is entirely written in Chinese, including headings and instructions, with no indication that another language is supported or that the Chinese-only format is required for a specific regional or compliance reason. This can violate a language/locale policy when users are not given an explicit choice or opt-in.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: This markdown file uses Chinese section headings such as '关键文件' and '关键链接' without any indication that the skill is region-specific or that language selection is optional. That can conflict with a language/locale policy requiring user choice or documented justification for a fixed language.

Static analysis

No suspicious patterns detected.