Security audit

Seamless Restart

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for restart recovery, but it gives an agent broad restart, cron, messaging, and persisted-state authority without enough safeguards around confirmation, retained context, or post-restart task resumption.

Review before installing. Use this only for explicitly approved gateway restart workflows, avoid saving secrets or private message contents in NOW.md, delete recovery state after use, and require a fresh user confirmation before applying config changes or resuming side-effecting tasks after restart.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:32
Finding: Untrusted Conversation State Is Persisted and Reused as Agent Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:32
Finding: Plaintext Retention of Conversation Context and Channel Identifiers
Content: View full analysis
, guildId=)` | | Telegram | `message(action=send, channel=telegram, target=)` | | Other | Use the channel and target from the pre-restart session | Always include the channel target in the NOW.md so the recovery cron knows where to send. ``` ### Technical Analysis The skill requires conversation context, active-task information, and channel or chat identifiers to be written to `NOW.md` in the workspace root. It does not define restrictive file permissions, data minimization rules, secret redaction, a retention period, or secure deletion. The post-restart procedure only clears the `Post-Restart Action` section. It does not remove the session identifier, active tasks, recent context, status, or channel target. As a result, potentially sensitive metadata and conversation summaries may remain in plaintext beyond the recovery period. ### Attack Path 1. A conversation contains sensitive task details, user co ...[truncated 1087 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation guidance is overly broad, telling the agent to use this skill whenever the user mentions terms like restart or apply config, even if a gateway restart may not actually be appropriate. In a privileged operational skill, ambiguous triggers can cause unnecessary or premature execution of disruptive actions, increasing the risk of accidental service interruption or misuse.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
})

text
The cron job is automatically deleted after it fires (one-shot). ### Step 3: Execute Restart

Static analysis

No suspicious patterns detected.