ECCSystem

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:47 AM UTC
• Version: 1.0.2

Overview

This is mostly a disclosed bundle installer, but it persistently changes local agent skills and its uninstall path can delete entire matching skill directories it may not own.

Review the full list of installed skills before use. Avoid --force unless you intend to replace existing skills, run --dry-run first, and be especially careful with --uninstall because it can remove whole same-named skill directories and their extra files. Prefer pinned versions for any npx/npm commands from the bundled security-scan guidance.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: bundle/security-scan.md:31

Finding

Unpinned Third-Party Package Is Downloaded and Executed

Content

View full analysis

Remediation

View remediation

scan . ``` 2. Verify the pinned package's provenance and integrity before recommending it. 3. Prefer a project-local dependency governed by a committed lockfile instead of global installation. 4. Avoid presenting `npm install -g` as the recommended option because it changes user-wide tooling and increases impact. 5. In automated environments, disable or separately review dependency lifecycle scripts where feasible. 6. Require explicit user confirmation before downloading and executing a package that will inspect configuration files. 7. Document which files the scanner reads and whether any scan data is transmitted externally. 8. Re-audit the package before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/install-ecc-bundle.py:106

Finding

Uninstaller Recursively Deletes Entire Pre-Existing Skill Directories

Content

View full analysis

//SKILL.md` as sufficient proof that the entire directory belongs to this bundle. It then passes the directory to `shutil.rmtree`, recursively deleting every file and subdirectory under it. The installer does not maintain a manifest of files it created. It can also skip an existing Skill during installation when `--force` is not supplied, but the skipped Skill name remains in the static `SKILLS` list used by the uninstaller. Therefore, the uninstaller can delete a pre-existing Skill that this bundle never installed. When forced installation creates a backup such as `SKILL.md.bak-`, that backup is stored in the same directory and is also deleted during uninstall. Custom files subsequently added to an installed Skill directory are similarly removed. ### Attack Path 1. A target directory already contains a Skill whose name matches an entry in the bundle's static `SKILLS` list. 2. The existing directory contains `SKILL.md` and may also contain scripts, assets, user modifications, or other data. 3. The bundle installer skips that Skill because `SKILL.md` already exists and `--force` was not used. 4. The user later runs: ```bash python scripts/install-ecc-bundle.py --uninstall --target ``` 5. The uninstaller observes the pre-existing `SKILL.md`. 6. `shutil.rmtree(skill_dir)` recursively d ...[truncated 915 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (91)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description frames the bundle as installing an ECC essentials subset, but the documented behavior includes a broader fixed set of 23 skills and an uninstall mode that removes installed directories. This mismatch undermines informed consent: users may authorize installation believing a narrower or non-destructive action is occurring, while the actual package can add more capabilities and perform removals.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The documented '--force' overwrite behavior enables replacement of existing skill definitions in the local agent environment, which is a form of self-modification/persistent configuration tampering. In the context of agent skills, overwriting trusted skills can silently change future agent behavior, making this more dangerous than an ordinary file copy operation.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

Preview mode

python scripts/install-ecc-bundle.py --dry-run

Force overwrite existing skills

python scripts/install-ecc-bundle.py --force

text

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 57)May include surrounding context.

md

set -e

# Step 1: Implement the feature
claude -p "Read the spec in docs/auth-spec.md. Implement OAuth2 login in src/auth/. Write tests first (TDD). Do NOT create any new documentation files."

# Step 2: De-sloppify (cleanup pass)
claude -p "Review all files changed by the previous commit. Remove any unnecessary type tests, overly defensive checks, or testing of language features (e.g., testing that TypeScript generics work). Keep real business logic tests. Run the test suite after cleanup."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 60)May include surrounding context.

md

claude -p "Read the spec in docs/auth-spec.md. Implement OAuth2 login in src/auth/. Write tests first (TDD). Do NOT create any new documentation files."

# Step 2: De-sloppify (cleanup pass)
claude -p "Review all files changed by the previous commit. Remove any unnecessary type tests, overly defensive checks, or testing of language features (e.g., testing that TypeScript generics work). Keep real business logic tests. Run the test suite after cleanup."

# Step 3: Verify
claude -p "Run the full build, lint, type check, and test suite. Fix any failures. Do not add new features."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 63)May include surrounding context.

md

claude -p "Review all files changed by the previous commit. Remove any unnecessary type tests, overly defensive checks, or testing of language features (e.g., testing that TypeScript generics work). Keep real business logic tests. Run the test suite after cleanup."

# Step 3: Verify
claude -p "Run the full build, lint, type check, and test suite. Fix any failures. Do not add new features."

# Step 4: Commit
claude -p "Create a conventional commit for all staged changes. Use 'feat: add OAuth2 login flow' as the message."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 66)May include surrounding context.

claude -p "Run the full build, lint, type check, and test suite. Fix any failures. Do not add new features."

Step 4: Commit

claude -p "Create a conventional commit for all staged changes. Use 'feat: add OAuth2 login flow' as the message."

text

### Key Design Principles

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 81)May include surrounding context.

With model routing:

bash

# Research with Opus (deep reasoning)
claude -p --model opus "Analyze the codebase architecture and write a plan for adding caching..."

# Implement with Sonnet (fast, capable)
claude -p "Implement the caching layer according to the plan in docs/caching-plan.md..."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 84)May include surrounding context.

md

claude -p --model opus "Analyze the codebase architecture and write a plan for adding caching..."

# Implement with Sonnet (fast, capable)
claude -p "Implement the caching layer according to the plan in docs/caching-plan.md..."

# Review with Opus (thorough)
claude -p --model opus "Review all changes for security issues, race conditions, and edge cases..."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 87)May include surrounding context.

claude -p "Implement the caching layer according to the plan in docs/caching-plan.md..."

Review with Opus (thorough)

claude -p --model opus "Review all changes for security issues, race conditions, and edge cases..."

text

**With environment context:**

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 94)May include surrounding context.

bash

# Pass context via files, not prompt length
echo "Focus areas: auth module, API rate limiting" > .claude-context.md
claude -p "Read .claude-context.md for priorities. Work through them in order."
rm .claude-context.md

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 101)May include surrounding context.

With --allowedTools restrictions:

bash

# Read-only analysis pass
claude -p --allowedTools "Read,Grep,Glob" "Audit this codebase for security vulnerabilities..."

# Write-only implementation pass
claude -p --allowedTools "Read,Write,Edit,Bash" "Implement the fixes from security-audit.md..."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 104)May include surrounding context.

claude -p --allowedTools "Read,Grep,Glob" "Audit this codebase for security vulnerabilities..."

Write-only implementation pass

claude -p --allowedTools "Read,Write,Edit,Bash" "Implement the fixes from security-audit.md..."

text

---

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 342)May include surrounding context.

bash

# Step 1: Implement (let it be thorough)
claude -p "Implement the feature with full TDD. Be thorough with tests."

# Step 2: De-sloppify (separate context, focused cleanup)
claude -p "Review all changes in the working tree. Remove:

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 345)May include surrounding context.

md

claude -p "Implement the feature with full TDD. Be thorough with tests."

# Step 2: De-sloppify (separate context, focused cleanup)
claude -p "Review all changes in the working tree. Remove:
- Tests that verify language/framework behavior rather than business logic
- Redundant type checks that the type system already enforces
- Over-defensive error handling for impossible states

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 360)May include surrounding context.

bash

for feature in "${features[@]}"; do
  # Implement
  claude -p "Implement $feature with TDD."

  # De-sloppify
  claude -p "Cleanup pass: review changes, remove test/code slop, run tests."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 363)May include surrounding context.

md

claude -p "Implement $feature with TDD."

  # De-sloppify
  claude -p "Cleanup pass: review changes, remove test/code slop, run tests."

  # Verify
  claude -p "Run build + lint + tests. Fix any failures."

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 366)May include surrounding context.

md

claude -p "Cleanup pass: review changes, remove test/code slop, run tests."

  # Verify
  claude -p "Run build + lint + tests. Fix any failures."

  # Commit
  claude -p "Commit with message: feat: add $feature"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 369)May include surrounding context.

claude -p "Run build + lint + tests. Fix any failures."

Commit

claude -p "Commit with message: feat: add $feature" done

text

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 576)May include surrounding context.

4. Ralphinho's tiered approach in simpler loops — Even in a sequential pipeline, you can route simple tasks to Haiku and complex tasks to Opus:

   bash

   # Simple formatting fix
   claude -p --model haiku "Fix the import ordering in src/utils.ts"
   
   # Complex architectural change
   claude -p --model opus "Refactor the auth module to use the strategy pattern"
   

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · bundle/autonomous-loops.md (reported line 579)May include surrounding context.

claude -p --model haiku "Fix the import ordering in src/utils.ts"

Complex architectural change

claude -p --model opus "Refactor the auth module to use the strategy pattern"

text

---

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · bundle/codebase-onboarding.md (reported line 69)May include surrounding context.

Key Directories Map the top-level directories to their purpose:

text

src/components/  → React UI components
src/api/         → API route handlers

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · bundle/deep-research.md (reported line 25)May include surrounding context.

md

- **firecrawl** — `firecrawl_search`, `firecrawl_scrape`, `firecrawl_crawl`
- **exa** — `web_search_exa`, `web_search_advanced_exa`, `crawling_exa`

Both together give the best coverage. Configure in `~/.claude.json` or `~/.codex/config.toml`.

## Workflow

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bundle/docker-patterns.md (reported line 266)May include surrounding context.

md

services:
  app:
    env_file:
      - .env                     # Never commit .env to git
    environment:
      - API_KEY                  # Inherits from host environment

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bundle/docker-patterns.md (reported line 289)May include surrounding context.

md

services:
  app:
    env_file:
      - .env                     # Never commit .env to git
    environment:
      - API_KEY                  # Inherits from host environment

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bundle/docker-patterns.md (reported line 363)May include surrounding context.

md

services:
  app:
    env_file:
      - .env                     # Never commit .env to git
    environment:
      - API_KEY                  # Inherits from host environment

Static analysis

No suspicious patterns detected.