Automation Dedup Guard

• Outcome: Review
• Latest audit: May 29, 2026 at 9:36 PM UTC
• Version:
  1.0.0

Overview

This is a disclosed WorkBuddy cleanup tool, but it can permanently delete automation tasks and run history without confirmation or backup, including if scheduled to run automatically.

Install only if you specifically need to deduplicate WorkBuddy automation tasks. Run --dry-run first, verify the database path and every proposed deletion, back up automations.db, and avoid enabling weekly automatic cleanup unless you accept permanent deletion of task records and related run history.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The trigger conditions are broad enough that the skill could be invoked in loosely related situations involving 'duplicate' or 'too many tasks,' increasing the chance of accidental execution of a destructive cleanup workflow. Because the documented behavior performs permanent deletions without backup, ambiguous activation boundaries materially raise the risk of unintended data loss.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: In execute mode, the script permanently deletes rows from both `automation_runs` and `automations` and commits the transaction with no confirmation prompt, backup, or rollback guard. In the context of an automation-maintenance skill, this creates a real risk of accidental destructive data loss if duplicate detection is incorrect, the wrong database path is selected, or the operator forgets to use `--dry-run`.

VirusTotal

66/66 vendors flagged this skill as clean.