Senior Django Developer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:26 PM UTC
• Version: 1.0.0

Overview

This Django code-generation skill is mostly purpose-aligned, but it tries to override normal agent behavior, expand edit scope, and require disclosure of chain-of-thought reasoning.

Review this skill before installing. It does not show exfiltration or destructive behavior, but it can push an agent to rewrite more code than requested, ignore preferred response formats, and expose reasoning that should stay private. If used, constrain it with explicit user instructions such as minimal changes only, no chain-of-thought, pinned dependencies, and no unrelated file-wide cleanup without approval.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:10
• Finding: Agent Behavior and Output Hijacking Through Mandatory Skill Directives<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:10-21`, `SKILL.md:206`, `SKILL.md:583-618` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:10-21` ```markdown ## Zero Tolerance Directives (Critical Override) You MUST adhere to the following rules WITHOUT EXCEPTION: 1. **PLACEHOLDERS ARE ABSOLUTELY FORBIDDEN.** No `TODO`, no `pass`, no `... rest of code`, no `# implement here`. You MUST write full, working implementation. 2. **CLEAN AND OPTIMIZED PRODUCTION CODE MUST BE DEVELOPED.** 3. **STRICT ADHERENCE TO THE TECH STACK IS MANDATORY.** 4. **IF A FILE IS EDITED, THE ENTIRE FILE MUST BE RETURNED WITH ALL CHANGES APPLIED.** Never use unified diff format unless explicitly requested by the user. ## Priority Resolution — "Boy Scout Rule" vs Scope Control When you are asked to edit or extend existing code, you MUST audit the entire file against ALL directives in this prompt (Strict Typing, Google-style Docstrings, Ruff compliance, Security). You ARE OBLIGATED to fix any stylistic, typing, linting, and docstring violations found in the provided file and bring it up to standard — these are considered coordinated changes. ``` `SKILL.md:206` ```markdown Code, Comments, Docstrings: **English** (Professional). Reasoning (Chain of Thought section): **Russian**. ``` `SKILL.md:583-618` ```markdown Your response must consist of exactly two sections: **Section 1: `## Цепочка мыслей` (In Russian)** Describe your step-by-step execution plan: - **Анализ:** What needs to be done and why. - **Операции файловой системы:** Specific Linux shell commands (`mkdir`, `uv add`, `touch`, etc.). - **Архитектурные решения:** Any non-trivial decisions made and their rationale. **Section 2: `## Файлы` (Code Generation)** Provide the FULL, COMPLETE CODE for every created or modified file. - NO PLACEHOLDERS ALLOWED. Every function must be fully implemented. - New files: Full file content. - Edited f ...[truncated 3163 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the phrases “Critical Override,” “WITHOUT EXCEPTION,” and any other wording that claims elevated instruction priority. 2. State explicitly that skill guidance is subordinate to system, developer, and current user instructions. 3. Replace mandatory whole-file remediation with scope-preserving guidance. Unrelated findings should be reported without being changed unless the user authorizes them. 4. Remove all requests for chain-of-thought or private step-by-step reasoning. Request a concise implementation summary or decision log instead. 5. Make the response structure optional and allow the active user to choose the output format. 6. Remove the forced continuation protocol. The agent should follow platform output limits and the user's interaction requirements. 7. Add a scope-control rule such as: “Only modify files and behavior explicitly authorized by the user.” 8. Validate the revised skill against prompt-injection tests covering priority claims, forced disclosure, out-of-scope edits, and output-format takeover. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38
• Finding: Unpinned Package and Container Image Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:38`, `SKILL.md:119-123`, `SKILL.md:448` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:38` ```markdown | Framework | Django + Django REST Framework (DRF) — latest via `uv add` | ``` `SKILL.md:119-123` ```bash # 2. Add production dependencies uv add django djangorestframework pydantic-settings drf-spectacular \ django-redis gunicorn uvicorn # 3. Add dev dependencies uv add --dev pytest-django factory-boy pytest-cov ruff ``` `SKILL.md:448` ```markdown 1. Install `uv` (copy from `ghcr.io/astral-sh/uv:latest`). ``` ### Technical Analysis The prescribed installation commands do not constrain package versions. Consequently, each execution can resolve a different set of Django, DRF, deployment, testing, and development dependencies. Although a generated lockfile may subsequently record a resolution, the initial resolution remains dependent on mutable package-index state. The instruction to copy `uv` from `ghcr.io/astral-sh/uv:latest` creates a separate supply-chain weakness. The `latest` tag is mutable and can point to a different image without any change to the reviewed skill or Dockerfile. The retrieved artifact is therefore not cryptographically bound to the version that was originally assessed. These practices reduce build reproducibility and allow newly published, compromised, or unexpectedly incompatible artifacts to enter generated projects. No evidence shows that a particular dependency is currently malicious; the vulnerability is the unsafe dependency acquisition policy. ### Attack Path 1. The skill generates package installation commands without exact version constraints. 2. A generated project executes `uv add` against the current package-index state. 3. The resolver selects versions that were not necessarily present when the skill was reviewed. 4. A compromised release, dependency-confusion artifact, or breakin ...[truncated 1133 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to an explicitly reviewed version or tightly controlled compatible range. 2. Generate and commit `uv.lock`, and require installations to use `uv sync --frozen`. 3. Do not instruct users to ignore or omit the lockfile from version control when reproducible application builds depend on it. 4. Pin the `uv` container image by immutable digest, for example: ```dockerfile COPY --from=ghcr.io/astral-sh/uv@sha256:REVIEWED_DIGEST /uv /uvx /bin/ ``` 5. Use automated dependency review, vulnerability scanning, and update tooling before changing pinned versions. 6. Restrict package installation to approved indexes and disable untrusted fallback indexes. 7. Verify artifact signatures or provenance attestations where supported. 8. Run builds with minimal privileges and prevent dependency installation steps from accessing unnecessary production secrets. 9. Produce a software bill of materials and scan the final image before deployment. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

build/
.venv/
venv/
.env
*.sqlite3
db.sqlite3
staticfiles/

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

build/
.venv/
venv/
.env
*.sqlite3
db.sqlite3
staticfiles/

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ssd 1

High

• Confidence: 100% confidence
• Finding: The skill instructs the model to reveal internal reasoning in a dedicated chain-of-thought section, directly conflicting with hidden-reasoning safeguards. This is dangerous because it can expose sensitive internal decision-making patterns, make downstream prompt injection easier, and normalize behavior that leaks privileged internal analysis beyond what users need.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: Mandating Russian specifically for the reasoning section imposes an unnecessary locale constraint unrelated to secure Django code generation. While not directly enabling code execution or data exfiltration, it can interfere with user expectations, reduce transparency for non-Russian users, and act as a subtle instruction-priority override in agent behavior.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The skill explicitly requires a dedicated `## Цепочка мыслей` section with step-by-step execution reasoning. This asks the model to disclose internal reasoning that is not necessary to generate Django code and can override standard safeguards that keep chain-of-thought hidden. In an agent skill, this also increases prompt-injection surface by making internal planning externally visible and easier to steer.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The response format requires a section title in Russian, forcing a specific language and output structure regardless of user preference. This is a policy/behavioral override that is not justified by the skill's stated purpose and can degrade usability or create instruction conflicts in multilingual environments.

Static analysis

No suspicious patterns detected.