T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:56- Finding
Untrusted GitHub Issue Content Can Hijack Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
git-mender
Security checks for vulnerabilities and agentic risk
Overview
This skill is disclosed as an automated GitHub issue fixer, but it needs review because it can read untrusted issue content, edit repositories, and run repository-defined commands on the user's machine.
Review before installing. Use this only with repositories and issue authors you trust, or run it in a disposable/sandboxed development environment. Carefully review commands, diffs, and PR text before approving any push or pull request creation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:221- Finding
Repository-Controlled Test and Lint Commands Execute Without Isolation
- Content
View full analysis
/dev/null cargo clippy 2>/dev/null go vet ./... 2>/dev/null ``` ``` ### Technical Analysis The Skill accepts a user-selected GitHub repository, clones it, detects its build system, and runs repository-defined tests and lint tasks. These operations are not passive validation. Common test and build systems execute arbitrary code supplied by the repository: - `npm test` and `npm run lint` execute package scripts. - `make test` executes commands from the repository's `Makefile`. - Gradle and Maven execute build plugins and project tasks. - `pytest` imports test modules, configuration files, and plugins. - Cargo build scripts can execute during compilation. - A repository can supply executable wrappers such as `gradlew`. The workflow does not require sandboxing, source trust verification, command review, netw ...[truncated 2024 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a functional skill that automates fixing GitHub issues and creating pull requests. The actual code chunk is strictly an installation script for deploying SKILL.md into a local skills directory and optionally uninstalling it. While installer behavior can be a supporting component, this chunk by itself does not perform the core declared functionality at all. Therefore the description does not accurately represent what this supplied code chunk actually does.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Option 3: Manual Install
bash mkdir -p ~/.qoder/skills/git-mender cp SKILL.md ~/.qoder/skills/git-mender/SKILL.md
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash mkdir -p ~/.qoder/skills/git-mender cp SKILL.md ~/.qoder/skills/git-mender/SKILL.md🚀 Usage
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description says the skill will automatically fix GitHub issues, but it does not clearly warn that it may modify repository code and submit pull requests autonomously. For a skill with write-side effects on source code and GitHub workflows, omission of that warning can mislead users about the level of autonomy and the scope of actions taken, increasing the chance of unintended code changes or unauthorized PR submissions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The security manifest is inaccurate: the script explicitly creates and writes to ~/.qoder/skills/git-mender/ despite claiming no local files are written. Misleading installation metadata can cause users or automated reviewers to underestimate filesystem changes, reducing transparency and weakening trust and review controls.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest claims the installer contacts GitHub via 'git clone only', but this script never performs any network operation. While this is not direct code execution risk, inaccurate network-use disclosures undermine security review and may mask future unexpected outbound behavior if users rely on the manifest.
- Content