Agent Collaboration Control

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:20 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed collaboration-governance protocol with a small local validator; it has operational caveats but no evidence of hidden credential access, exfiltration, or destructive behavior.

Install only from a source and version you trust, preferably pinned. Before using ongoing support watches, bind exact project targets, state paths, cadence, budget, stop conditions, and human escalation authority. Treat the validator as a schema helper only; it does not prove evidence truth, enforce permissions, or make a journal append-only.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:80

Finding

Unpinned Package Execution in Installation Instructions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/validate_transition_event.py:120

Finding

Configurable Regular Expression Allows Validation Denial of Service

Content

View full analysis

256: errors.append( "policy event_id_pattern must be a string of 1-256 characters" ) else: try: re.compile(pattern) except re.error as error: errors.append(f"policy event_id_pattern is invalid: {error}") ``` ```python event_id = event.get("id") id_pattern = policy.get("event_id_pattern", r"(?!x)x") if ( not isinstance(event_id, str) or re.fullmatch(id_pattern, event_id) is None ): errors.append("id does not match policy event_id_pattern") ``` ### Technical Analysis The policy accepts any syntactically valid regular expression up to 256 characters. It does not restrict nested or ambiguous quantifiers, and the event ID has no maximum length. Python's standard `re` engine uses backtracking and does not provide a match timeout in this code. A malicious policy can therefore define a pattern with catastrophic backtracking behavior. When that pattern is evaluated against a sufficiently long, carefully selected event ID, `re.fullmatch` can consume excessive CPU for an extended period. Successfully compiling a pattern only establishes syntactic validity; it does not establish safe matching complexity. ### Attack Path 1. An attacker gains the ability to supply or modify a collaboration policy consumed by the validator. 2. The attacker sets `event_id_pattern` to a syntactically valid expression containing nested or ambiguous repetition. 3. The attacker supplies an event with a long ID designed to nearly match the expression before failing. 4. The validator calls `re.fullmatch` using the attacker-controlled pattern and input. 5. Catastrophic backtracking consumes excessive CPU, delaying or b ...[truncated 564 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 3)May include surrounding context.

md

# Security

Please report vulnerabilities privately through GitHub's security advisory interface. Do not include credentials, private documents, access tokens, internal hostnames, or personal paths in a public issue.

This project provides agent instructions and local helpers. It is not a sandbox, an authorization system, or a guarantee that an external service is secure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied code does not perform the broad operational collaboration-control role claimed in the description. It only validates one transition event against a collaboration policy JSON object, checking required fields and formats, then exits with a status code. While this may support a larger collaboration-control system, the chunk itself neither establishes nor actively monitors collaboration, operates long-running automation, manages handoffs, enforces writer topology, performs liveness proof, or conducts adversarial review. Its actual behavior is a limited validation utility, so the declared description materially overstates and misrepresents the code’s primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a comprehensive operational collaboration-control system for multi-agent work, implying active governance, monitoring, handoff management, and runtime coordination. The supplied code chunk does not implement those behaviors; it is only a test file for a validator that checks whether transition-event and policy JSON structures conform to expected schemas and constraints. While transition-event validation is related to collaboration policy artifacts, the code’s actual role is narrow and supportive: exercising validation logic in unit tests. That is a materially different primary purpose from establishing and operating project-agnostic collaboration control, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to execute npx skills add AntreasAntoniou/agent-collaboration-control without pinning a specific version of the tooling. This creates a supply-chain risk because npx may fetch the latest package at execution time, so a compromised or malicious update to the skills package could execute unreviewed code on the user's machine.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation criteria are extremely broad and can cause the skill to activate for many ordinary tasks, especially because it claims applicability to ongoing support, experiments, artifact production, incident recovery, and handoffs across any project. In agentic systems, over-broad routing increases the chance that this high-authority governance skill is applied unnecessarily, leading to workflow capture, confusion about authority, and unsafe reliance on controls that may not actually be enforced.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_validate_transition_event.py:27