Better

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:22 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a static work-context note, but it embeds identifiable compensation and equity details that are broader than the stated day-to-day PM workflows need.

Review this skill before installing and remove or generalize salary, bonus, RSU, valuation, and vesting details unless you explicitly want those details loaded into agent context. Narrow the activation description to Better-specific tasks or named internal workflows so it does not trigger during unrelated meeting, project, or enterprise-tool requests.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:9

Finding

Plaintext Personal Employment and Compensation Information

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-16
Vulnerability Type: Plaintext sensitive data exposure
Risk Level: Medium

Evidence

markdown

Context for Tej's Senior PM role at Better Mortgage.

## Role

- **Title:** Senior PM, Borrower Communications
- **Focus:** Call routing, dialers, CRM systems, speed-to-lead optimization
- **Team:** Leads a team focused on lead intake → loan officer connection
- **Start Date:** December 2, 2024
- **Compensation:** $217K base + 15% bonus + 3,200 RSUs (4yr vest, quarterly, granted $10, current $29)
- **First RSU vest:** March 2, 2025 (800/yr = 200/quarter)

Technical Analysis

The reusable Skill stores personally attributable employment and financial information in plaintext. The exposed information includes the individual's employer context, role, start date, salary, bonus, equity allocation, grant valuation, current valuation, and vesting schedule.

Most declared Skill workflows—such as meeting preparation, project tracking, team coordination, and metrics analysis—do not require compensation or equity details. Loading this Skill therefore introduces sensitive information into the agent context beyond the principle of data minimization. The information could subsequently appear in model output, prompts sent to integrated services, execution logs, conversation archives, repository copies, or diagnostic traces.

This is a confidentiality weakness rather than a code-execution vulnerability. The audited project contains no scripts, dependencies, network retrieval logic, persistence mechanisms, or executable payloads.

Attack Path

1. An attacker obtains read access to the Skill package, a repository copy, an agent transcript, or logs containing the loaded Skill context.
2. Alternatively, an attacker with access to an agent session prompts the agent to summarize, repeat, or use the personal context loaded from the Skill.
3. The attacker extr ...[truncated 986 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove salary, bonus, RSU valuation, vesting dates, and other financial details from SKILL.md.
2. Replace personally identifying context with the minimum role-based information needed for the declared workflows, such as a generic job title and functional responsibilities.
3. If sensitive employment data is genuinely required, retrieve it only when explicitly requested from an access-controlled source rather than embedding it in a reusable Skill.
4. Require explicit user authorization before sensitive information is included in generated output or transmitted to an external integration.
5. Restrict repository and Skill-package access using least-privilege controls, and review logs, backups, and prior repository history for copies of the exposed data.
6. Add automated secret and sensitive-data scanning to the publication workflow, including checks for compensation, equity, personal dates, credentials, and other unnecessary personal information.
7. Establish retention and redaction controls for prompts, transcripts, telemetry, and downstream tool output that may contain loaded Skill context.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s activation description is very broad and covers generic workplace activities like meeting prep, project tracking, and team updates. That increases the chance of over-triggering on ordinary enterprise tasks, causing the agent to load sensitive work context unnecessarily and potentially influence unrelated actions with Better-specific internal information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.