Workspace Local Retrieval

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:50 AM UTC
• Version: 1.0.0

Overview

This is a coherent local retrieval starter that writes local templates, but users should be careful with the npm entrypoint and verify prerequisites before indexing anything.

Before installing, prefer a pinned npm version or trusted package source, run the check command yourself, and do not proceed to indexing until required prerequisites pass. Review the generated corpus allowlists and exclusions before any refresh or embedding workflow, especially if the workspace contains private notes, credentials, logs, or generated indexes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/workspace-local-retrieval.js:93

Finding

Installation Continues After Required Prerequisite Checks Fail

Content

View full analysis

Remediation

View remediation

=20", "details": "not found" } ``` 3. Determine blocking status using exact values rather than substring matching: ```javascript const blocking = payload.results.filter( (entry) => entry.ok === false && entry.requirementLevel === "required" ); ``` 4. Handle degraded modes separately. Missing `recommended` or `optional` capabilities should produce explicit warnings but should not be included in the blocking set. 5. Ensure the process exits nonzero on required failures so automated callers cannot mistake the result for a successful readiness check. 6. Add regression tests covering: - all required checks passing; - a required check failing, with no destination directory or files created; - only a recommended check failing; - only an optional check failing; - correct exit codes and completion messages for every case. 7. Avoid printing the normal success and next-step messages unless all required prerequisites have passed. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/bootstrap_workspace_retrieval.py (reported line 109)May include surrounding context.

python

def write_json(path: Path, payload: dict, force: bool) -> None:
    if path.exists() and not force:
        raise FileExistsError(f"Refusing to overwrite existing file without --force: {path}")
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(json.dumps(payload, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/bootstrap_workspace_retrieval.py (reported line 118)May include surrounding context.

python

parser = argparse.ArgumentParser(description="Bootstrap sanitized local retrieval templates.")
    parser.add_argument("--dest", required=True, help="Destination directory for generated retrieval config")
    parser.add_argument("--workspace-root", default="/ABSOLUTE/PATH/TO/WORKSPACE", help="Workspace root placeholder or absolute path")
    parser.add_argument("--force", action="store_true", help="Overwrite existing files")
    args = parser.parse_args()

    dest = Path(args.dest).expanduser().resolve()

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs users to execute npx workspace-local-retrieval, which resolves and runs a package from the registry without pinning an exact version. That can lead to unexpected code execution if a newer package release is malicious, compromised, or simply behaviorally incompatible, and the command is presented as a recommended one-line entrypoint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_retrieval_prereqs.py (reported line 25)May include surrounding context.

python

def run(cmd: list[str]) -> tuple[bool, str]:
    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (proc.stdout or proc.stderr).strip()
        return proc.returncode == 0, out
    except Exception as exc:  # noqa: BLE001