Ecc Bundle 2026 07 08

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:13 AM UTC
• Version: 1.0.0

Overview

This bundle appears purpose-aligned, but its installer and some bundled guidance can persistently change agent behavior and delete skill directories in ways users should review first.

Review the bundle before installing. Use --dry-run first, avoid --force unless you intend to replace existing skills, and do not run --uninstall against a skills directory that may contain custom files under the same skill names. Pin any npm/npx tools before use, and treat autonomous loop, model-routing, GitHub, and memory-index workflows as actions that need explicit cost, data, and repository-scope boundaries.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install-ecc-bundle.py:106

Finding

Uninstall Recursively Deletes Unverified Skill Directories

Content

View full analysis

Vulnerability Details

File Location: scripts/install-ecc-bundle.py, lines 106-112
Vulnerability Type: Missing ownership validation before recursive deletion
Risk Level: High

Vulnerable Code

python

for skill_name in SKILLS:
    dst = target / skill_name / "SKILL.md"
    if dst.exists():
        if not dry_run:
            # 删除整个目录
            skill_dir = target / skill_name
            if skill_dir.exists():
                shutil.rmtree(skill_dir)

Technical Analysis

The uninstaller treats the existence of a file named SKILL.md as sufficient proof that the entire parent directory belongs to this bundle. It then passes that directory to shutil.rmtree, recursively deleting every file and subdirectory it contains.

No installation manifest, ownership marker, content hash, or record of files created by the installer is checked. The user-controlled --target argument also allows the operation to be directed at a non-default directory tree. Consequently, a directory that existed before installation, was installed by a different package, or accumulated unrelated files after installation can be deleted in full.

This violates safe uninstall principles: an uninstaller should remove only artifacts whose ownership it can establish.

Attack Path

1. A target directory contains one of the hardcoded skill names, such as security-review.

2. That directory contains a SKILL.md, whether created by this bundle, another installer, or the user.

3. The same directory also contains unrelated files, custom configuration, or additional skill resources.

4. The user or an automated Agent invokes:

   bash

   python scripts/install-ecc-bundle.py --target /chosen/path --uninstall
   

5. The script finds the matching SKILL.md and recursively deletes the entire /chosen/path/security-review directory.

6. All unrelated content under that directory is permanently removed without an ...[truncated 532 chars]

Remediation

View remediation

Remediation Suggestions

1. Create an installation manifest recording every path created by the installer, along with a bundle identifier and optional file hash.
2. During uninstall, remove only files explicitly listed in that manifest.
3. Remove a skill directory only after verifying that it is empty.
4. Add a bundle-specific ownership marker inside each installed directory and validate it before deletion.
5. Resolve and validate the target path before use, ensuring every deletion remains under the intended target root.
6. Refuse uninstall when ownership cannot be established and report the directory for manual review.
7. Add a confirmation step that lists exact paths scheduled for deletion.
8. Preserve --dry-run and recommend it before destructive operations.
9. Add tests covering pre-existing directories, unrelated files, custom targets, and partially modified installations.

T08 · Insecure Dependencies

Warning

• Location: bundle/security-scan.md:33

Finding

Unpinned npm and npx Commands Execute Mutable Third-Party Packages

Content

View full analysis

Vulnerability Details

File Locations:

• bundle/security-scan.md, lines 33-41, 80-82, 93-97, and 108-110
• bundle/git-workflow.md, line 459
• bundle/search-first.md, line 134

Vulnerability Type: Unpinned third-party package installation and execution
Risk Level: Medium

Vulnerable Code

bundle/security-scan.md, lines 33-41:

bash

# Check if installed
npx ecc-agentshield --version

# Install globally (recommended)
npm install -g ecc-agentshield

# Or run directly via npx (no install needed)
npx ecc-agentshield scan .

bundle/security-scan.md, lines 80-82:

bash

npx ecc-agentshield scan --fix

bundle/security-scan.md, lines 93-97:

bash

# Requires ANTHROPIC_API_KEY
export ANTHROPIC_API_KEY=your-key
npx ecc-agentshield scan --opus --stream

bundle/security-scan.md, lines 108-110:

bash

npx ecc-agentshield init

Additional unpinned package operations include:

bash

npx conventional-changelog -i CHANGELOG.md -s

text

Action: ADOPT — npm install textlint-rule-no-dead-link

Technical Analysis

These instructions identify packages only by mutable registry names. They do not pin an exact reviewed version, verify a package integrity hash, require a lockfile, or constrain lifecycle scripts.

If the package is unavailable locally, npx can resolve and execute registry content. A global npm installation also creates a persistent executable in the user's environment. Package installation may run npm lifecycle scripts with the invoking user's privileges.

The risk is elevated for ecc-agentshield because the documented commands direct it to inspect Agent configuration files, initialize configuration, automatically modify files with --fix, and access ANTHROPIC_API_KEY during deep analysis. A compromised or unexpectedly changed package version could therefore access sensitive local configuration and environment varia ...[truncated 1445 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every executable package to an exact reviewed version, such as ecc-agentshield@X.Y.Z.
2. Maintain a lockfile with verified registry integrity metadata.
3. Prefer a reviewed local development dependency invoked through the package manager rather than ad hoc npx retrieval.
4. Do not recommend global installation by default.
5. Disable or carefully review npm lifecycle scripts during installation where feasible.
6. Require explicit user approval before package installation, --fix, init, or any operation that modifies configuration.
7. Run security scanners in a sandbox with project-scoped filesystem access and restricted network access.
8. Pass only the specific API key needed for deep analysis and avoid exposing unrelated environment variables.
9. Document which files and data the scanner may transmit during model-assisted analysis.
10. Pin GitHub Actions to reviewed commit SHAs rather than mutable major-version tags.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: bundle/blueprint.md:31

Finding

Blueprint Requests Unbounded Memory Access and Persistent Memory Updates

Content

View full analysis

Vulnerability Details

File Location: bundle/blueprint.md, lines 31-37
Vulnerability Type: Overbroad Agent-state access and insufficiently scoped persistent writes
Risk Level: Medium

Vulnerable Code

markdown

Blueprint runs a 5-phase pipeline:

1. **Research** — Pre-flight checks (git, gh auth, remote, default branch), then reads project structure, existing plans, and memory files to gather context.
2. **Design** — Breaks the objective into one-PR-sized steps (3–12 typical). Assigns dependency edges, parallel/serial ordering, model tier (strongest vs default), and rollback strategy per step.
3. **Draft** — Writes a self-contained Markdown plan file to `plans/`. Every step includes a context brief, task list, verification commands, and exit criteria — so a fresh agent can execute any step without reading prior steps.
4. **Review** — Delegates adversarial review to a strongest-model sub-agent (e.g., Opus) against a checklist and anti-pattern catalog. Fixes all critical findings before finalizing.
5. **Register** — Saves the plan, updates memory index, and presents the step count and parallelism summary to the user.

Technical Analysis

The instructions refer generically to “memory files” and a “memory index” without defining their paths, ownership, scope, allowed content, or trust boundary. They also direct the Agent to inspect GitHub authentication and repository remotes as part of planning.

Generating a construction plan ordinarily requires access to the current project and explicitly supplied requirements. Reading unspecified memory stores and checking account-authentication state may expose unrelated cross-session context or account metadata beyond that minimum requirement.

The resulting plan is intentionally self-contained and persistent. If unrelated sensitive material is read during research and incorporated into the plan, it can be propagated to project files or sub-agents. Updating an undef ...[truncated 1509 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace “memory files” with an explicit allowlist of project-local paths.
2. Define the exact memory index location and require it to remain under the current project.
3. Do not inspect global Agent memory unless the user explicitly authorizes it.
4. Make GitHub authentication checks optional and request consent before accessing account-related state.
5. Use commands that report only whether authentication is available, without printing tokens or credential material.
6. Redact secrets, personal data, private remote URLs, and unrelated memory content before writing plans.
7. Present the proposed plan and memory-index update to the user before persisting either one.
8. Restrict sub-agents to the finalized, redacted plan rather than forwarding raw memory content.
9. Document retention, overwrite, and deletion behavior for the memory index.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (99)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description frames the skill as a bundle installer, but the documented behavior also includes uninstalling, force-overwriting existing skills, and modifying the general ~/.agents/skills directory. When destructive or wider-scope behaviors are omitted from the declared purpose, users and agents may grant trust under false assumptions and trigger file deletion or replacement they did not anticipate.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The skill explicitly supports overwriting existing installed skills, which is a form of self-modification or environment modification with potentially broad downstream effects. In the context of agent skills, replacing existing definitions can change future agent behavior, disable safeguards, or introduce persistence without the user fully noticing.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

Preview mode

python scripts/install-ecc-bundle.py --dry-run

Force overwrite existing skills

python scripts/install-ecc-bundle.py --force

text

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 57)May include surrounding context.

md

set -e

# Step 1: Implement the feature
claude -p "Read the spec in docs/auth-spec.md. Implement OAuth2 login in src/auth/. Write tests first (TDD). Do NOT create any new documentation files."

# Step 2: De-sloppify (cleanup pass)
claude -p "Review all files changed by the previous commit. Remove any unnecessary type tests, overly defensive checks, or testing of language features (e.g., testing that TypeScript generics work). Keep real business logic tests. Run the test suite after cleanup."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 60)May include surrounding context.

md

claude -p "Read the spec in docs/auth-spec.md. Implement OAuth2 login in src/auth/. Write tests first (TDD). Do NOT create any new documentation files."

# Step 2: De-sloppify (cleanup pass)
claude -p "Review all files changed by the previous commit. Remove any unnecessary type tests, overly defensive checks, or testing of language features (e.g., testing that TypeScript generics work). Keep real business logic tests. Run the test suite after cleanup."

# Step 3: Verify
claude -p "Run the full build, lint, type check, and test suite. Fix any failures. Do not add new features."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 63)May include surrounding context.

md

claude -p "Review all files changed by the previous commit. Remove any unnecessary type tests, overly defensive checks, or testing of language features (e.g., testing that TypeScript generics work). Keep real business logic tests. Run the test suite after cleanup."

# Step 3: Verify
claude -p "Run the full build, lint, type check, and test suite. Fix any failures. Do not add new features."

# Step 4: Commit
claude -p "Create a conventional commit for all staged changes. Use 'feat: add OAuth2 login flow' as the message."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 66)May include surrounding context.

claude -p "Run the full build, lint, type check, and test suite. Fix any failures. Do not add new features."

Step 4: Commit

claude -p "Create a conventional commit for all staged changes. Use 'feat: add OAuth2 login flow' as the message."

text

### Key Design Principles

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 81)May include surrounding context.

With model routing:

bash

# Research with Opus (deep reasoning)
claude -p --model opus "Analyze the codebase architecture and write a plan for adding caching..."

# Implement with Sonnet (fast, capable)
claude -p "Implement the caching layer according to the plan in docs/caching-plan.md..."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 84)May include surrounding context.

md

claude -p --model opus "Analyze the codebase architecture and write a plan for adding caching..."

# Implement with Sonnet (fast, capable)
claude -p "Implement the caching layer according to the plan in docs/caching-plan.md..."

# Review with Opus (thorough)
claude -p --model opus "Review all changes for security issues, race conditions, and edge cases..."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 87)May include surrounding context.

claude -p "Implement the caching layer according to the plan in docs/caching-plan.md..."

Review with Opus (thorough)

claude -p --model opus "Review all changes for security issues, race conditions, and edge cases..."

text

**With environment context:**

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 94)May include surrounding context.

bash

# Pass context via files, not prompt length
echo "Focus areas: auth module, API rate limiting" > .claude-context.md
claude -p "Read .claude-context.md for priorities. Work through them in order."
rm .claude-context.md

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 101)May include surrounding context.

With --allowedTools restrictions:

bash

# Read-only analysis pass
claude -p --allowedTools "Read,Grep,Glob" "Audit this codebase for security vulnerabilities..."

# Write-only implementation pass
claude -p --allowedTools "Read,Write,Edit,Bash" "Implement the fixes from security-audit.md..."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 104)May include surrounding context.

claude -p --allowedTools "Read,Grep,Glob" "Audit this codebase for security vulnerabilities..."

Write-only implementation pass

claude -p --allowedTools "Read,Write,Edit,Bash" "Implement the fixes from security-audit.md..."

text

---

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 342)May include surrounding context.

bash

# Step 1: Implement (let it be thorough)
claude -p "Implement the feature with full TDD. Be thorough with tests."

# Step 2: De-sloppify (separate context, focused cleanup)
claude -p "Review all changes in the working tree. Remove:

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 345)May include surrounding context.

md

claude -p "Implement the feature with full TDD. Be thorough with tests."

# Step 2: De-sloppify (separate context, focused cleanup)
claude -p "Review all changes in the working tree. Remove:
- Tests that verify language/framework behavior rather than business logic
- Redundant type checks that the type system already enforces
- Over-defensive error handling for impossible states

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 360)May include surrounding context.

bash

for feature in "${features[@]}"; do
  # Implement
  claude -p "Implement $feature with TDD."

  # De-sloppify
  claude -p "Cleanup pass: review changes, remove test/code slop, run tests."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 363)May include surrounding context.

md

claude -p "Implement $feature with TDD."

  # De-sloppify
  claude -p "Cleanup pass: review changes, remove test/code slop, run tests."

  # Verify
  claude -p "Run build + lint + tests. Fix any failures."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 366)May include surrounding context.

md

claude -p "Cleanup pass: review changes, remove test/code slop, run tests."

  # Verify
  claude -p "Run build + lint + tests. Fix any failures."

  # Commit
  claude -p "Commit with message: feat: add $feature"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 369)May include surrounding context.

claude -p "Run build + lint + tests. Fix any failures."

Commit

claude -p "Commit with message: feat: add $feature" done

text

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 576)May include surrounding context.

4. Ralphinho's tiered approach in simpler loops — Even in a sequential pipeline, you can route simple tasks to Haiku and complex tasks to Opus:

   bash

   # Simple formatting fix
   claude -p --model haiku "Fix the import ordering in src/utils.ts"
   
   # Complex architectural change
   claude -p --model opus "Refactor the auth module to use the strategy pattern"
   

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 579)May include surrounding context.

claude -p --model haiku "Fix the import ordering in src/utils.ts"

Complex architectural change

claude -p --model opus "Refactor the auth module to use the strategy pattern"

text

---

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · bundle/codebase-onboarding.md (reported line 69)May include surrounding context.

Key Directories Map the top-level directories to their purpose:

text

src/components/  → React UI components
src/api/         → API route handlers

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · bundle/deep-research.md (reported line 25)May include surrounding context.

md

- **firecrawl** — `firecrawl_search`, `firecrawl_scrape`, `firecrawl_crawl`
- **exa** — `web_search_exa`, `web_search_advanced_exa`, `crawling_exa`

Both together give the best coverage. Configure in `~/.claude.json` or `~/.codex/config.toml`.

## Workflow

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bundle/docker-patterns.md (reported line 266)May include surrounding context.

md

services:
  app:
    env_file:
      - .env                     # Never commit .env to git
    environment:
      - API_KEY                  # Inherits from host environment

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bundle/docker-patterns.md (reported line 289)May include surrounding context.

md

services:
  app:
    env_file:
      - .env                     # Never commit .env to git
    environment:
      - API_KEY                  # Inherits from host environment

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bundle/docker-patterns.md (reported line 363)May include surrounding context.

md

services:
  app:
    env_file:
      - .env                     # Never commit .env to git
    environment:
      - API_KEY                  # Inherits from host environment

Static analysis

No suspicious patterns detected.