T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
pattern_recognizer.py:137- Finding
Unrestricted Inspection of Agent Memory Journals
- Content
View full analysis
- Remediation
View remediation
Security audit
Workbuddy Smart Learning
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent local learning/memory tool, but it stores behavioral history and can read or write an unexpected hard-coded workspace path.
Install only if you are comfortable with a local learning system that records feedback, task history, tool use, and derived patterns. Do not use it on sensitive work until the hard-coded workspace path is removed, the target workspace is explicit, and there are clear controls to inspect, disable, and delete stored memory data.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
signal_collector.py:275- Finding
Excessive Plaintext Retention of Task Telemetry and User Content
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
learn.py:183- Finding
Hard-Coded Cross-Workspace Filesystem Target
- Content
View full analysis
str: """Command line: generate signal report""" workspace = "c:/Users/Administrator/WorkBuddy/20260412210819" collector = SignalCollector(workspace) return collector.generate_signal_report(days) ``` ```python def run_profiler_report(days: int = 30) -> str: """Command line: generate profile report""" workspace = "c:/Users/Administrator/WorkBuddy/20260412210819" analyzer = TaskProfilerAnalyzer(workspace) return analyzer.generate_profiler_report(days) ``` ### Technical Analysis The primary CLI ignores the current project directory and does not accept a workspace argument. Instead, it always initializes the learning system against a fixed path associated with an administrator account. Every subsystem derives its storage and input directories from this value. Consequently, documented commands such as `python learn.py full` can create, read, and modify the following locations beneath an unrelated workspace: - `.workbuddy/memory/feedback/` - `.workbuddy/memory/signals/` - `.workbuddy/memory/task_profiles/` - `.workbuddy/memory/patterns/` - `.workbuddy/memory/templates/` On Windows, the code may access another user or project workspace if the running account has permission. On non-Windows platforms, the Windows-style path may be interpreted as an unexpected relative path containing `c:`, causing data to be written to an unintended location. Because the system reads memory journals and writes behavioral state, this is more severe than a harmless portability defect ...[truncated 1378 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (26)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python **当前任务摘要**： """ + (last_task_summary or "（无）") return prompt if __name__ == "__main__":
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python }) except (yaml.YAMLError, OSError): continue return rules def generate_distillation_report(self, distilled: dict, templates_created: int = 0) -> str: """生成蒸馏报告"""
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module is explicitly designed for 'implicit' collection of behavioral signals and persists task summaries, timing, cancellation state, tool usage, notes, and custom metrics to disk under a hidden application directory without any consent, notice, minimization, or retention controls. In an agent skill context, this creates a privacy and telemetry risk because sensitive work patterns and potentially confidential task content can be recorded silently and later exposed through local compromise, over-collection, or unintended reuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README explicitly states that the system collects implicit signals such as reuse rate and wait time, but it does not disclose consent, retention, scope, or privacy implications. In a learning/memory system, silent behavioral data collection can expose user activity patterns and create persistent profiling without informed user awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README describes automatically reading memory on every new session and using it to generate suggestions, but does not warn that persistent historical data will be accessed each time. This creates a privacy and transparency issue because prior session data may be surfaced or influence behavior without explicit user awareness or session-level consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language instructions and descriptions throughout the file are written in Chinese with no indication that users may choose another language. Under the policy rule, forcing a specific language without opt-in is a locale/language policy concern unless the constraint is explicitly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill documents persistent storage of feedback, implicit signals, task profiles, patterns, and templates under .workbuddy/memory/, but does not warn users about retention or the sensitivity of those records. Stored execution traces and feedback notes can accumulate sensitive operational context over time and be exposed to other local users, backup systems, or later components that read from this directory.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly describes passive collection of five categories of behavioral signals ('无感采集') and derives a health score from them, but provides no user-facing notice, consent flow, or controls. Silent telemetry about cancellations, durations, tool success, and repeated corrections can expose sensitive work habits and preferences, creating a privacy risk even if stored locally.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the system to read MEMORY.md and recent daily memory records whenever historical context is detected, without user approval, scope limitation, or data minimization. Automatic ingestion of prior memory can surface unrelated sensitive information into new conversations and broaden exposure of retained data beyond the user's immediate request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill's natural-language descriptions and generated feedback prompt are written exclusively in Chinese, which imposes a specific language/locale on users without any opt-in or documented justification. The policy specifically calls for flagging language or locale constraints when the skill does not offer user choice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module persists user feedback, including free-form notes and tags, to disk automatically with no consent flow, disclosure, retention control, or minimization. If users provide sensitive information in feedback, this creates a privacy and compliance risk because data is stored locally in a predictable location and may be accessed by other local processes or users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generated prompt presented to users is entirely in Chinese and does not provide any language-selection mechanism. This is a direct natural-language policy issue because the skill forces a locale-specific interaction rather than offering a choice or documenting a justified restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code file contains natural-language strings and documentation entirely in Chinese, including the module description and user-facing messages later in the file, with no indication that the user can choose another language. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module title, descriptions, CLI help text, and user-facing output strings are all written exclusively in Chinese, and there is no indication that users can select another language or that the skill is intended only for a Chinese-speaking environment. This creates a natural-language locale policy concern because the skill appears to impose a specific language by default rather than through explicit opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file contains module documentation and multiple user-facing strings entirely in Chinese, including reports returned to users. The skill does not offer any language selection or opt-in mechanism, which creates a locale/language policy concern under the natural-language policy rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Natural-language strings and documentation in the file are consistently Chinese-only, including the module description and operational docstrings. This can violate language-choice policy when the skill forces a locale or language without explicitly offering alternatives or documenting a justified locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module's natural-language descriptions are exclusively in Chinese and present the skill as a Chinese-language system without indicating that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module persistently records task metadata and tool execution history to disk under a hidden workspace directory without any visible consent, disclosure, retention control, or minimization. Even though it does not exfiltrate data, it creates a local activity log that may contain sensitive task summaries, timestamps, and workflow details that other local users, processes, or later components could access.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python with_template = [p for p in profiles if p.get("template_id")] without_template = [p for p in profiles if not p.get("template_id")] def stats(plist): if not plist: return {"count": 0, "success_rate": 0.0, "avg_duration": 0.0} success_count = sum(1 for p in plist if p.get("success"))
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python with_template = [p for p in profiles if p.get("template_id")] without_template = [p for p in profiles if not p.get("template_id")] def stats(plist): if not plist: return {"count": 0, "success_rate": 0.0, "avg_duration": 0.0} success_count = sum(1 for p in plist if p.get("success"))
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python with_template = [p for p in profiles if p.get("template_id")] without_template = [p for p in profiles if not p.get("template_id")] def stats(plist): if not plist: return {"count": 0, "success_rate": 0.0, "avg_duration": 0.0} success_count = sum(1 for p in plist if p.get("success"))
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python with_template = [p for p in profiles if p.get("template_id")] without_template = [p for p in profiles if not p.get("template_id")] def stats(plist): if not plist: return {"count": 0, "success_rate": 0.0, "avg_duration": 0.0} success_count = sum(1 for p in plist if p.get("success"))
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python with_template = [p for p in profiles if p.get("template_id")] without_template = [p for p in profiles if not p.get("template_id")] def stats(plist): if not plist: return {"count": 0, "success_rate": 0.0, "avg_duration": 0.0} success_count = sum(1 for p in plist if p.get("success"))
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python with_template = [p for p in profiles if p.get("template_id")] without_template = [p for p in profiles if not p.get("template_id")] def stats(plist): if not plist: return {"count": 0, "success_rate": 0.0, "avg_duration": 0.0} success_count = sum(1 for p in plist if p.get("success"))
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The document says feedback prompting is automatically appended after every task, but does not clearly warn users that this will happen continuously. While lower risk than silent telemetry, undisclosed always-on prompting can influence user behavior, create nuisance interactions, and cause users to disclose more information than expected into persistent records.
- Content