Security audit

World Model

Security checks for vulnerabilities and agentic risk

Overview

The skill’s world-model purpose is coherent, but it persistently tracks broad user, agent, environment, session, and business state without clear privacy controls.

Install only if you are comfortable with a skill that may persist local telemetry about the agent, user intent, environment, tools, sessions, actions, predictions, and business context. Prefer using it in a private workspace, review or delete its JSON state/log files regularly, and avoid feeding secrets or sensitive user content into prediction contexts until retention and redaction controls are added.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Note

Location: world-state.json:1
Finding: Plaintext Storage of Environment and Agent Profiling Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: predictions-log.json:17
Finding: Prediction Log Retains Session and Free-Form Action Metadata in Plaintext
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly describes environment and state tracking, and elsewhere shows collection of agent, user, temporal, and business/session fields, but it does not warn users that detailed session/state information may be retained. In a high-priority AGI component, this omission increases the risk of silent collection or misuse of behavioral and contextual data because operators may enable or integrate it without informed consent or retention controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The caching and pattern-learning sections show retention of action, context, outcome, timestamps, and learned sequences, yet the skill provides no disclosure or safeguards around this persistence. That creates privacy and operational risk because sensitive prompts, decisions, or contextual metadata could be stored, reused, or surfaced later without visibility, especially in an AGI decision-support component that may process broad system and user context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The wrapper dynamically loads and executes world_model.py at runtime via importlib and exec_module(), which runs top-level code from that file immediately. In a skill ecosystem where skill contents are untrusted or third-party supplied, this creates a clear code-execution boundary crossing without validation, sandboxing, or any disclosure, making malicious or unsafe module code execute as soon as the wrapper is initialized.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The world state schema fixes the timezone to "Asia/Jerusalem," which can imply a locale-specific default in the skill's natural-language documentation. The file does not state that locale is configurable or that this region-specific value is only an example, so it risks violating the language/locale neutrality requirement.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: This JSON manifest-like file includes the cause value "run_evolution_cycle", which reads like an invocation or activation phrase but provides no context about when it should be used or what should not trigger it. In a manifest/config file, trigger-like language without explicit scope or exclusion criteria can be overly broad and cause unintended matching.
Content: No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Confidence: 50% confidence
Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Content: Scanner excerpt · unified_wrapper.py (reported line 28)May include surrounding context.
python
# Find the main class for name in dir(module): obj = getattr(module, name) if isinstance(obj, type) and name != "UnifiedSkill": self._original = obj() break

Static analysis

No suspicious patterns detected.