Security audit

improve-codebase-architecture

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate architecture-review aid, but it asks for broad project memory access and opens a generated report that runs third-party browser scripts.

Install only if you are comfortable with the agent reading cross-session project memory and producing a browser-opened HTML report that fetches Tailwind and Mermaid from public CDNs. Prefer reviewing or modifying the skill to remove `.claude/MEMORY.md` access, use local or static report assets, set Mermaid to strict mode, sanitize repository-derived content, and ask before opening files or changing `.claude/CONTEXT.md` or `.specs/`.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:40
Finding: Mandatory Access to Cross-Session Agent Memory Violates Least Privilege
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: references/HTML-REPORT.md:3
Finding: Generated Reports Execute Mutable JavaScript from External CDNs
Content: View full analysis
Architecture review — {{repo name}} ``` The report-generation instruction additionally states: ```markdown Write a self-contained HTML file to the OS temp directory so nothing lands in the repo. Resolve the temp dir from `$TMPDIR`, falling back to `/tmp` (or `%TEMP%` on Windows), and write to `/architecture-review-.html` so each run gets a fresh file. Open it for the user — `xdg-open ` on Linux, `open ` on macOS, `start ` on Windows — and tell them the absolute path. The report uses **Tailwind via CDN** for layout and styling, and **Mermaid via CDN** for diagrams where a graph/flow/sequence reliably communicates the structure. ``` ### Technical Analysis The generated local HTML report executes JavaScript fetched at viewing time from public CDN URLs. The Tailwind URL has no version pin, and Mermaid is pinned only to major version `11`, allowing the effective code to change after the Skill has been reviewed. No Subresource Integrit ...[truncated 1610 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/HTML-REPORT.md:61
Finding: Untrusted Repository Data Is Rendered with Mermaid Loose Security
Content: View full analysis
``` ```markdown ### Mermaid graph (the workhorse for dependencies / call flow) Use a Mermaid `flowchart` or `graph` when the point is "X calls Y calls Z, and look at the mess." Wrap it in a Tailwind-styled card so it doesn't feel parachuted in. Style with classDef to colour leakage edges red and the deep module dark. Sequence diagrams work well for "before: 6 round-trips; after: 1." ```html

text
flowchart LR A[OrderHandler] --> B[OrderValidator] B --> C[OrderRepo] C -.leak.-> D[PricingClient] classDef leak stroke:#dc2626,stroke-width:2px; class C,D leak

``` ``` ### Technical Analysis The report contains repository-derived module names, file paths, domain vocabulary, and architectural descriptions. The instructions do not require HTML escaping, attribute encoding, Mermaid-label quoting, URL validation, directive filtering, or sanitization before inserting those values into the generated document. Mermaid is explicitly initialized with `securityLevel: "loose"`. This mode permits more permissive rendering behavior than strict mode and is inappropriate when diagram source may contain attacker-influenced repository text. There are two relevant injection surfaces: 1. Dynamic content inserted into ordinary HTML without contextual escaping. 2. Dynamic content inserted into Mermaid source without Mermaid-specific san ...[truncated 1369 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to write an HTML file to disk and open it with a platform launcher, but gives no prior warning or consent checkpoint. Silent filesystem writes plus automatic opening of a browser/application can surprise users, trigger unintended execution contexts, and expose them to locally rendered active content.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly requires loading Tailwind and Mermaid from external CDNs, which introduces unnecessary outbound network access during a local architecture review. This expands the trust boundary to third-party infrastructure, can leak metadata, and creates a supply-chain/script-injection risk if the CDN content changes or is compromised.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions explicitly require asking the user in Portuguese after the report is written. This forces a specific language for user-facing output without opt-in, even though the skill is otherwise described for both English and Portuguese usage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs repository modifications to .claude/CONTEXT.md and creation of .specs/ files during the conversation without an upfront warning that the analysis may change tracked project files. In a code-assistance context, undisclosed writes to repo state can cause integrity, review, and workflow issues even if the content is well-intentioned.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill is described as an architecture-review aid, but later instructs the agent to modify project context files and create new SPEC documents. That scope expansion turns a read/analyze workflow into a write-capable workflow, increasing the chance of unintended repository changes and making the skill materially more dangerous than its headline purpose suggests.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The report format explicitly requires loading Tailwind and Mermaid from external CDNs even though the skill's purpose is to generate a local architecture review. That creates unnecessary outbound network access, leaks metadata about local usage, and introduces supply-chain risk if the CDN content changes or is compromised.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Mermaid is initialized with securityLevel: "loose", which weakens Mermaid's built-in HTML/script safety restrictions. In a reporting skill that may render repository-derived content into diagrams, this raises the risk of HTML injection or script-adjacent content being interpreted in the generated report.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The tone section requires 'Plain English' and further enforces exact wording and banned substitutes, effectively forcing a specific language/style without user opt-in. Under the policy, language constraints should either offer user choice or be clearly justified as region- or compliance-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The document instructs the agent to load third-party CDN resources but provides no user-facing disclosure that generating the report will trigger network access. In this skill context, users would reasonably expect a local architecture review artifact, so silent network use can violate privacy and trust expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file instructs users to 'Use these terms exactly' and forbids substitutes, which imposes a language policy on all suggestions generated by the skill. Under the policy-violation category, forcing a specific language or vocabulary without user opt-in is in scope.
Content: No source excerpt is available for this finding.