Security audit

Inbox Monitoring

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly aligned with inbox monitoring, but it asks for recurring authenticated monitoring with persistent cron automation and weak handling of logs, state, and consent.

Install only if you are comfortable giving the skill access to Pulse inbox and network-request data. Avoid setting up the cron example unless you review the actual script, use private state and log directories, limit the API key, and know how to stop the recurring job.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

Location: SKILL.md:77
Finding: Persistent Inbox Monitoring Through a Scheduled Cron Task
Content: View full analysis
> /tmp/pulse-inbox-monitor.log 2>&1 ``` ``` ### Technical Analysis The skill instructs the user or agent to configure a cron task that executes every 15 minutes. A cron entry survives the original skill invocation and continues operating across terminal and agent sessions, creating system-level persistence. The scheduled process is intended to access private inbox information using an API credential available in its execution environment. Moreover, the referenced `scripts/inbox-monitor-cron.sh` file is absent from the audited project, so its implementation and eventual behavior cannot be verified from the package under review. If a script is later placed or replaced at that path, cron will execute it repeatedly with the privileges of the account that owns the cron entry. ### Attack Path 1. A user or agent follows the documented cron configuration. 2. A persistent scheduled task is installed for the relevant operating-system account. 3. Every 15 minutes, cron resolves and executes `/path/to/pulse-skills/scripts/inbox-monitor-cron.sh`. 4. The script may inherit access to the Pulse API credential and process private inbox data. 5. An attacker who can create or replace the script at the referenced path can cause attacker-controlled commands to run repeatedly. 6. Execution continues after the initiating session ends and remains active until the cron entry is explicitly removed. ### Impact Assessment The cron task provides persistent execution under the privileges of the account that installs it. Its intended scope includes recurring authenticated access to Pulse conversations, network requests, and potentially network context. If th ...[truncated 264 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:28
Finding: Bearer API Credential Exposed Through Process Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:81
Finding: Predictable Shared Temporary Files for Sensitive Monitoring Data
Content: View full analysis
> /tmp/pulse-inbox-monitor.log 2>&1 ``` ```markdown Optional envs: - `PULSE_INBOX_VIEW` (`all` | `me` | `coo`, default: `all`) - `PULSE_INBOX_LIMIT` (default: `50`) - `PULSE_INBOX_STATE_FILE` (default: `/tmp/pulse-inbox-monitor-state.json`) ``` ### Technical Analysis The documented log and state files use fixed, predictable names in the shared `/tmp` directory. The cron shell opens the log with append redirection and may follow a pre-existing symbolic link. The referenced monitoring script is not present, so the audit cannot confirm whether the state file is created atomically, protected against symbolic links, or assigned restrictive permissions. On a multi-user system, an attacker with access to `/tmp` may pre-create one of these paths, replace it with a symbolic link, inspect an overly permissive file, or manipulate state used to decide which inbox items are new. The feasibility and effect of symbolic-link attacks depend on host protections, file ownership, target permissions, and the implementation of the absent script. ### Attack Path 1. An attacker predicts `/tmp/pulse-inbox-monitor.log` or `/tmp/pulse-inbox-monitor-state.json`. 2. Before monitoring begins, the attacker creates the path, creates a symbolic link at the path, or waits for an insecurely permissioned file to appear. 3. The scheduled command opens the predictable log path, or the monitoring script reads or writes the predictable state path. 4. The attacker may read sensitive inbox summaries, corrupt state, suppress alerts, cause repeated alerts, or redirect writes to another file accessible to the monitoring account. 5. The operation repeats every 15 minutes if the documented cron task remains installed. ### Impa ...[truncated 587 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list includes broad natural-language phrases like 'new messages' and 'pending requests' plus API-path fragments, which can cause the skill to activate during ordinary discussion rather than an explicit user request. In a monitoring skill that accesses authenticated inbox data, unintended invocation can expose sensitive message metadata or cause background checks the user did not clearly intend.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs repeated polling of conversations and network requests using a bearer token and even suggests scheduled automation, but it provides no user-facing privacy notice, consent step, retention guidance, or warning about monitoring other parties' communications. That omission is risky because the skill handles potentially sensitive inbox and relationship data on a recurring basis, increasing the chance of overcollection, unnoticed surveillance, or accidental disclosure in logs and summaries.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The trigger list includes the Chinese phrase '收件箱监控' alongside English triggers, but the document does not explain language selection or indicate that multilingual triggering is user-configurable. This can be a locale/language policy issue when a skill implicitly supports or privileges a language without documented opt-in.
Content: No source excerpt is available for this finding.