Bubbletea Code Review

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:23 PM UTC
• Version: 2.3.2

Overview

This is a documentation-only BubbleTea review skill, but it depends on an unbundled sibling skill for required verification.

Review or bundle the referenced review-verification-protocol skill before relying on this package. The included files themselves are low-risk markdown guidance, but the mandatory external dependency means the final behavior can change depending on what exists at the sibling path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Uncontrolled Cross-Skill Instruction Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18
Vulnerability Type: Unversioned external Skill dependency outside the project root
Risk Level: Medium

Vulnerable Code Snippet:

markdown

| **G3 — Verification** | Before publishing review output, you applied the **[review-verification-protocol](../review-verification-protocol/SKILL.md)** to each proposed finding. |

Technical Analysis

The Skill makes successful completion of its review process dependent on instructions loaded from ../review-verification-protocol/SKILL.md. This relative path escapes the audited project root, while the referenced Skill is not bundled, version-pinned, or integrity-verified by this artifact.

Consequently, the effective behavior of the Skill cannot be determined solely from the reviewed files. The dependency could be absent, causing the verification gate to fail, or replaced with different instructions after this Skill has been audited. If an attacker can create or modify the sibling path, the mandatory G3 gate causes attacker-controlled instructions to be incorporated into each review.

This is a supply-chain and instruction-integrity weakness. The audited project itself contains no malicious payload, but it delegates a required part of its behavior to an uncontrolled external component.

Attack Path

1. An attacker obtains write access to the parent directory or controls installation of the sibling review-verification-protocol Skill.
2. The attacker creates or modifies ../review-verification-protocol/SKILL.md with instructions designed to suppress findings, alter severity ratings, disclose review data, or redirect the agent's output.
3. A user invokes the bubbletea-code-review Skill.
4. The G3 hard gate requires the agent to load and apply the sibling Skill before publishing findings.
5. The attacker-controlled instructions influence the audit process and its final report.

Exploitation therefore requi ...[truncated 797 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the verification protocol within this project, such as under references/, so all effective instructions are included in the auditable artifact.
2. Replace the parent-directory reference with a path constrained to the Skill root.
3. If an external dependency is unavoidable, pin it to an immutable, trusted version and verify its cryptographic digest before use.
4. Define expected behavior locally and treat external material as non-authoritative reference content rather than mandatory instructions.
5. Fail closed with a clear diagnostic when the approved dependency is missing or fails integrity verification.
6. Include the verification protocol in release reviews and provenance records so changes to it trigger a new security audit.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/composition.md (reported line 527)May include surrounding context.

md

1. Are sub-components properly initialized?
2. Are sub-component updates propagated?
3. Is WindowSizeMsg passed to all components needing resize?
4. Is there a clear state machine for view transitions?
5. Is focus tracked and components blurred/focused correctly?
6. Are Huh forms embedded correctly (not using blocking Run())?

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This section claims BubbleTea models 'must be immutable' and labels the first example as bad because it mutates m.items, but the purported 'GOOD' example also assigns m.items = newItems. That is an active contradiction between the documentation intent and what the sample code actually demonstrates, which could mislead reviewers about what behavior to flag.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/elm-architecture.md (reported line 31)May include surrounding context.

md

return func() tea.Msg {
        // This closure is NOT executed during Update()
        // The runtime schedules it for async execution
        data, _ := http.Get("https://api.example.com/data")
        return DataLoadedMsg{data}
    }
}

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown teaches BubbleTea command patterns using examples that perform an HTTP request and later returns data, and elsewhere demonstrates reading a local config file. The document explains execution behavior but does not warn readers that these operations may transmit data externally or access local files, which is the kind of user-impact warning expected for markdown descriptions covering data/privacy or system-affecting behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.