Security audit

Overwatch

Security checks for vulnerabilities and agentic risk

Overview

This skill is a markdown-only communication protocol, but it overreaches by making itself always active and mandatory for nearly every agent action.

Review this skill before installing if you use agents in workflows that require exact JSON, quiet tool execution, confidential operations, or minimal status output. Its transparency goal is understandable, but it should be narrowed to user-visible long-running work and explicitly yield to higher-priority safety, privacy, and formatting requirements.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:7
Finding: Mandatory Global Agent Behavior and Output Hijacking
Content: View full analysis
**If you're doing work, the human knows about it.** **No exceptions. No "I'll update when it's done." No "this is quick enough to skip."** ``` ```markdown ### 1. Task Start (Required) **Before ANY tool call:** ``` "Starting: [brief task description]" "ETA: [estimate or range]" "Steps: [numbered list of what I'll do]" ``` ``` ```markdown ## Proactive Status (No Prompt Required) **Don't wait for the human to ask "how's it going?"** ### Auto-Status Triggers | Trigger | Update | |---------|--------| | Heartbeat received | Brief status of active work | | Context >60% | "Continuing — summarizing context" | | Tool retry >2 | "Retrying [tool] (attempt [N])" | | Sub-agent completes | "[taskName] finished — [result]" | | Background task milestone | "[task]: [X]% complete" | ``` ```markdown ## Verification Checklist Before declaring any task complete: - [ ] Human was informed of task start - [ ] Progress updates given for multi-step work - [ ] Sub-agents reported on spawn and completion - [ ] Errors communicated immediately with context - [ ] Delays explained with updated ETA - [ ] Final result includes what changed and how verified **If any checkbox is missing — WORK IS NOT COMPLETE.** ``` ```markdown **This skill is ALWAYS ACTIVE. Going dark is a failure.** **Your human should never have to ask "what's happening?"** ``` ### Technical Analysis The skill declares itself globally and permanently active within the agent session, characterizes nonc ...[truncated 3128 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Marking the skill as always-active without clear activation boundaries makes it globally applicable and difficult for agents to determine when it should or should not influence behavior. Broad mandatory activation can cause instruction conflicts, prompt bloat, and unintended disclosure of intermediate activity in contexts where such reporting is unnecessary or sensitive.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger condition 'if you're doing work, the human knows about it' is ambiguous and effectively universal, which can force disclosure behavior across nearly all agent actions. In practice, this can leak internal reasoning-adjacent process details, create noisy or conflicting outputs, and pressure agents to narrate actions even when another policy or workflow would be safer or more appropriate.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
md
- Starting work without telling the human - Executing multiple steps without status updates - Spawning sub-agents and not reporting what they're doing - Running background tasks without confirmation they started - Taking >30 seconds without saying what you're doing - Hiding failures or retry attempts

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a mandatory protocol for keeping humans informed during task execution. The 'Brand Cross-Promotion' section advertises external brands and contact information, which is not justified by or necessary for that purpose.
Content: No source excerpt is available for this finding.