Security audit

Automation Testing Protocol

Security checks for vulnerabilities and agentic risk

Overview

The skill is a QA/testing guide, but it broadly tells agents to run project code and create test files without clear user control.

Install only if you want agents to apply a strict testing protocol to automation projects. Before use, make sure agents ask before running repository tests, using real service credentials, or creating a new run_tests.py file, especially in untrusted projects.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill claims authority over testing 'any automation project' and instructs the agent to apply the protocol broadly without explicit trigger boundaries, repository scoping, or user confirmation. In an agentic environment, this can cause inappropriate invocation, unnecessary file inspection, or actions on unrelated projects, increasing the chance of unsafe changes or execution in the wrong context.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to discover and execute `run_tests.py`, and to create one if missing, without requiring user approval, sandboxing, or warning that this will write files and run arbitrary project code. In a hostile or untrusted repository, executing a test runner can trigger arbitrary code execution, data exfiltration, destructive file changes, or network access under the agent's privileges.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: The document requires timestamps and scheduling to be synchronized to the environment's local time and gives `Africa/Cairo` as the example, which can be read as imposing a specific locale expectation. Because no user choice or explicit regional limitation is provided, this may conflict with language/locale policy guidance.

Static analysis

No suspicious patterns detected.