Security audit

diagnose

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent debugging skill with disclosed workflows; its risks are normal debugging/logging exposure rather than hidden or malicious behavior.

This skill is reasonable to install for structured debugging. Before using it, remember that debugging artifacts such as logs, HAR files, dumps, stack traces, SQL logs, and command output can contain secrets or personal data; redact them and avoid sensitive-data logging on production or customer data. Review any generated shell command before running it, especially custom commands passed to scripts or npx/npm examples.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Context Leakage

High

Category: Data Exfiltration
Confidence: 75% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
Content: Scanner excerpt · references/defense-in-depth.md (reported line 14)May include surrounding context.

Entry point — reject obviously invalid input at the API boundary (null/empty, existence, type, shape).

Business logic — reject values that are syntactically fine but wrong for this operation.

Environment guard — refuse dangerous operations in the wrong context (e.g. in tests, refuse destructive commands outside the temp dir; in prod, refuse admin paths on a read replica).

Debug instrumentation — capture context (args, cwd, stack) right before the risky operation, so the next failure carries its own evidence.

typescript
// Example spread across layers for "empty projectDir → git init in source tree"

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/hitl-loop.template.sh (reported line 10)May include surrounding context.
sh
# bash hitl-loop.template.sh # # Two helpers: # step "<instruction>" → show instruction, wait for Enter # capture VAR "<question>" → show question, read response into VAR # # At the end, captured values are printed as KEY=VALUE for the agent to parse.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instruction says all questions and findings reported to the user must be in Portuguese (pt-BR), which forces a specific language regardless of the user's preference. This is a natural-language policy issue because the file does not offer a language choice, opt-in, or clear region-specific justification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is described as a root-cause debugging aid for hard code bugs, but it also authorizes agent self-debugging and AI workflow auditing. That scope expansion can cause the agent to leave the user’s requested task boundary and perform broader introspection or system assessment actions that were not clearly consented to, increasing the chance of unintended data exposure or misuse of capabilities.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The AI workflow scoring/auditing section introduces an evaluation capability unrelated to the stated bug-diagnosis purpose. In practice, this can steer the agent into reviewing prompts, tools, architecture, and safety posture beyond the reported defect, which broadens access to sensitive operational context and may produce actions or judgments outside the user’s intended scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The playbook recommends enabling EF Core sensitive-data logging and only notes 'DEV ONLY' in an inline code comment, without an explicit warning in the surrounding guidance about the risk of exposing query parameter values, secrets, or personal data in logs. In a debugging skill, users may copy-paste the snippet into real environments or leave it enabled longer than intended, creating avoidable data exposure through application logs.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.