Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed multi-agent coding workflow that can run other coding agents and edit repositories when invoked, with no hidden exfiltration or persistence found.
Install this only if you intend to orchestrate headless coding agents. Use read-only mode for reviews/scouts, use disposable git worktrees for write mode, review scope-check output before committing, and be careful with OpenCode write mode because the artifact itself notes it has no OS sandbox.
The mismatch here is security-relevant because the skill frames itself as workflow guidance while referencing subprocess supervision, locking, and shell execution primitives. Hidden or underemphasized operational behavior in an agent skill can mislead users about the real trust boundary and cause them to grant or use dangerous system-level capabilities without informed consent.
The mismatch here is security-relevant because the skill frames itself as workflow guidance while referencing subprocess supervision, locking, and shell execution primitives. Hidden or underemphasized operational behavior in an agent skill can mislead users about the real trust boundary and cause them to grant or use dangerous system-level capabilities without informed consent.
The mismatch here is security-relevant because the skill frames itself as workflow guidance while referencing subprocess supervision, locking, and shell execution primitives. Hidden or underemphasized operational behavior in an agent skill can mislead users about the real trust boundary and cause them to grant or use dangerous system-level capabilities without informed consent.
The mismatch here is security-relevant because the skill frames itself as workflow guidance while referencing subprocess supervision, locking, and shell execution primitives. Hidden or underemphasized operational behavior in an agent skill can mislead users about the real trust boundary and cause them to grant or use dangerous system-level capabilities without informed consent.
Referenced artifact was not completely inspected
| `scripts/brief.mjs <spec.json> --out <file>` | Assembles a brief from a JSON spec; refuses missing values, excerpts or keywords |
Referenced artifact was not completely inspected
| `scripts/brief.mjs <spec.json> --out <file>` | Assembles a brief from a JSON spec; refuses missing values, excerpts or keywords |
Referenced artifact was not completely inspected
| `scripts/spawn.mjs --harness claude\|codex\|opencode ...` | Runs one headless agent; writes `result.json` (session id, exit, tokens) and a ledger row |
Referenced artifact was not completely inspected
| `scripts/excerpt.sh`, `scripts/conv.sh` | A pattern excerpt; the matching convention bullets, verbatim |
Referenced artifact was not completely inspected
| `scripts/excerpt.sh`, `scripts/conv.sh` | A pattern excerpt; the matching convention bullets, verbatim |
Referenced artifact was not completely inspected
| `scripts/codemap.mjs <repo> [groups] \| --generic` | Generates `docs/CODEMAP.md` (JS/TS workspaces, or any git repo) |
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
it on stdin, or as "Read and follow <path> exactly" for the Agent tool. The file is the audit trail
and the base for the next fix brief.
- One worktree per writing executor. Readers (reviewers, scouts) may share a checkout.
- Record the session id of every run (`result.json` -> `sessionId`). Re-reviews and blocked-question
answers resume THAT id, never "the last session".
- Fix rounds start a FRESH session; resuming a builder multiplies cost with its transcript.
- Run every CLI as a tracked background job and judge it by its exit code and `result.json`.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# that would hide files is itself a change outside the map. NUL-delimited, so any file name works.
G=(git -C "$W" -c diff.renames=false -c core.quotePath=false -c core.fsmonitor=false -c core.untrackedCache=false)
tmp=$(mktemp -d) || exit 2
trap 'rm -f "$tmp/index" "$tmp/index.lock" "$tmp/list"; rmdir "$tmp" 2>/dev/null' EXIT
export GIT_INDEX_FILE="$tmp/index"
if ! "${G[@]}" read-tree "$BASE" || ! "${G[@]}" add -A -- . \
|| ! "${G[@]}" diff --cached --no-renames --name-only -z "$BASE" -- > "$tmp/list"; then
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- The scripts never read secrets, make network calls of their own, or install anything. `spawn.mjs`
starts the agent CLI you choose, in the working directory you pass, with your existing login.
- Write-mode executors run with auto-approved edits inside their working directory: give each one a
disposable git worktree. Read-only mode (reviews, scouts) cannot edit files.
- Every brief tells executors never to read secrets or credential files and to report anything the
brief does not decide instead of guessing.
The skill explicitly describes shell-capable scripts and environment-dependent execution but does not declare any tool scope or allowed-tools constraints. In an agent-skill ecosystem, missing scope boundaries can let a host or user invoke the skill with broader-than-expected shell access, increasing the chance of unintended command execution or repository modification.
The skill instructs users to spawn headless agents, write result files, and commit or push code changes, but it does not clearly warn that these actions modify the local system and repository state. In an agent context, omission of such warnings is dangerous because it can lead users to authorize autonomous changes, subprocess execution, or VCS operations without understanding the side effects.
The OpenCode guidance explicitly recommends --auto for write mode and notes there is no OS sandbox, which means a headless agent can perform file or system-affecting actions without interactive approval. Although the text does mention using a disposable worktree and permission config, the combination of auto-approval plus no sandbox materially increases the risk of unintended or overly broad actions in a multi-agent orchestration workflow.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
pass
try:
child = subprocess.Popen(cmd, start_new_session=True)
except OSError as exc:
fail(127, "%s: %s" % (cmd[0], exc.strerror or exc))
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
// exited 0 without a final report; 124 on timeout; 127 if the CLI is not on PATH; 2 on usage errors
// (nothing is written). Judge the run by this code and result.json, never by the final text.
//
// Modes: write = may edit files and run commands inside --dir; read-only = review/scout, no edits.
// claude: write -> --permission-mode <--permission, default auto>; read-only -> plan. Lean by
// default (no MCP servers, no skills, per-machine prompt sections moved out of the
// system prompt for cache reuse); --no-lean keeps the user's full setup.
Detected: suspicious.dangerous_exec