Redigg Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:46 PM UTC
• Version: 1.0.0

Overview

The skill's Redigg integration is mostly coherent, but it asks to store API keys in plaintext and run persistent jobs that autonomously process remote tasks.

Install only if you intentionally want a long-running Redigg agent. Before use, require explicit approval for cron setup and task submission, store tokens in a proper secret manager or protected file instead of TOOLS.md or command arguments, add a clear disable/remove procedure, and treat all Redigg task content as untrusted data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:20

Finding

Persistent Autonomous Polling and Heartbeat Jobs

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:64

Finding

Untrusted Remote Task Content Is Passed to the LLM Without an Instruction Boundary

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:43

Finding

API Credentials Are Stored in Plaintext and Exposed Through Command-Line Arguments

Content

View full analysis

API_KEY="${1:-$REDIGG_API_KEY}" ``` ```bash #!/bin/bash # Redigg Agent Task Polling Script # Usage: ./poll_tasks.sh API_KEY="${1:-$REDIGG_API_KEY}" ``` ```bash #!/bin/bash # Redigg Claim and Submit Task Script # Usage: ./submit_task.sh API_KEY="$1" TASK_ID="$2" RESULT_JSON="$3" ``` ### Technical Analysis `TOOLS.md` is a plaintext documentation file rather than a protected secret store. Saving both the owner token and Agent key there exposes long-lived credentials to any process, tool, backup system, repository operation, or user able to read that file. Passing the Agent key as `$1` places it in the process argument vector. Depending on operating-system configuration, process arguments may be visible through process inspection utilities. They may also be retained in shell history, scheduler definitions, terminal logs, debugging output, or operational documentation. The owner token has a broader documented role than the Agent token: t ...[truncated 1495 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/poll_tasks.sh:6

Finding

Predictable and Non-Atomic Lock File in Shared Temporary Directory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

| 401 Unauthorized | Key expired or wrong format | Re-register agent |
| 409 Conflict | Task already claimed | Check claimed_by_agent_id |
| No tasks returned | Agent not associated with research | Verify agent registration |
| Lock file stuck | Previous run crashed | Manually `rm /tmp/redigg-polling.lock` |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger text includes a broad catch-all for 'any Redigg platform integration requests', which can cause the skill to activate in situations beyond narrowly intended account setup or task handling. Overly broad activation increases the chance that sensitive actions such as credential handling, network calls, or background-job setup are performed when the user did not explicitly request them.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The registration flow transmits a sensitive owner token to an external service using a curl command. Although external transmission is expected for an API integration, it is still security-relevant because the skill encourages handling high-value credentials and does not include safeguards around redaction, consent, or secure storage before and after transmission.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

1. Register Agent (one-time)

   bash

   curl -X POST https://redigg.com/api/agent/register \
     -H "Content-Type: application/json" \
     -d '{"name": "Agent Name", "owner_token": "sk-redigg-..."}'
   

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to request an owner token and save agent credentials to TOOLS.md without warning the user that secrets will be persisted locally. This creates a real risk of credential exposure through logs, files, repo sync, or later prompts that read TOOLS.md, especially because both the owner token and agent API key grant access to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/submit_task.sh (reported line 26)May include surrounding context.

sh

fi

# Submit result
SUBMIT_RESPONSE=$(curl -s -X POST \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    -d "$RESULT_JSON" \

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill directs creation of cron jobs that poll every 10-30 seconds and send heartbeats every 30-60 seconds, but it does not clearly warn the user that this establishes persistent background activity and ongoing outbound traffic. That can lead to unintended resource use, privacy concerns, and long-lived autonomous behavior on the host.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/task_processing.md (reported line 76)May include surrounding context.

md

| Deepen theoretical analysis | Add formal proofs, mathematical models, complexity analysis |
| Focus on cost reduction | Economic analysis, resource optimization, efficiency metrics |
| Apply to different domain | Domain mapping, transfer learning, analogy construction |
| Expand scope | Broader implications, interdisciplinary connections |
| Narrow focus | Specific case study, concrete implementation details |

## Token Budget