T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/cron-templates.md:121- Finding
Autonomous Publishing Workflow Lacks Approval and Least-Privilege Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Org Manager
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a governance template set, but it includes ready-to-deploy scheduled jobs that can automatically publish skills and modify GitHub releases without clear human approval controls.
Install only if you intend to run a Chinese-language, cron-driven multi-agent governance workflow. Before deploying the cron templates, remove or gate the monthly publishing job behind human approval, repository allowlists, diff review, and least-privilege credentials. Treat repair-task error text as untrusted data and limit repair agents to the specific job and fields being fixed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
references/cron-templates.md:136- Finding
Untrusted Error Text Is Interpolated into an Autonomous Repair Prompt
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The metadata and trigger design are entirely Chinese-centric and do not indicate any language negotiation or fallback, which can force Chinese-language behavior for users interacting in other languages. In a skill meant to coordinate multi-agent governance, this can lead to misunderstanding of roles, policies, or audit instructions across agents and users, increasing the chance of operational errors.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The trigger phrase list contains broad, common terms such as 'Agent管理', 'Agent架构', and 'AI组织' that can match ordinary discussion rather than an explicit request to use this skill. This can cause unintended invocation, pulling the user into a strong governance workflow when they may only be asking a general question about multi-agent systems.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document title and embedded template messages require Chinese-language behavior and outputs, including Chinese filenames and Chinese report content, but the file does not offer a language choice or explain why this locale restriction is required. This is a natural-language policy issue because the skill imposes a specific language/locale without explicit opt-in or documented regional justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
These templates automate file writes, inter-session messaging, cron inspection, and external sync/publish behavior without prominently warning operators that the jobs can mutate state and send data outside the local workflow. In an agentic environment, missing safety notes and approval boundaries increase the chance that an operator deploys powerful scheduled actions without understanding persistence, notification, or external publication consequences.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The monthly maintenance template authorizes an automated agent to republish skills and perform GitHub commit/tag/push/release operations from a scheduled job. That materially expands the skill from organization management into unattended software supply-chain modification, creating risk of unauthorized code publication, accidental release of unsafe changes, and propagation of compromised skill content to external systems.
- Content