Agent Collaboration Control

• Outcome: Review
• Latest audit: Sep 5, 2026 · 5:29 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed collaboration-governance protocol with a local validator; its main risks are operational overhead, recurring read-only watches, and cautious installation hygiene.

Install from a reviewed or pinned source when possible. Use this skill for consequential multi-agent or long-running work, not routine single-agent tasks, and bind human authority, controller, auditor, journal paths, watch targets, cadence, and stop conditions before allowing mutations or recurring monitoring. Treat policy files as trusted configuration because pathological regex patterns can stall the validator.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:80
• Finding: Unpinned npx installation exposes users to mutable supply-chain code## Vulnerability Details **File Location**: `README.md:80-84` **Vulnerability Type**: Unpinned third-party installer and repository dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ## Install and start ```bash npx skills add AntreasAntoniou/agent-collaboration-control ``` ``` ### Technical Analysis The documented installation procedure invokes the npm-resolved `skills` command through `npx` without specifying a reviewed package version. It also identifies the Skill repository without pinning installation to an immutable commit. As a result, the code retrieved and executed or installed when a user follows this instruction can differ from the version covered by this audit. If the npm package, its dependency chain, maintainer account, or referenced repository is compromised, the installation command could retrieve malicious or unexpectedly modified content. The repository itself does not contain remote-payload execution logic, and this finding does not prove that the current upstream package is malicious. The risk arises from recommending execution of mutable third-party supply-chain components without version or integrity controls. ### Attack Path 1. An attacker compromises the npm package used by `npx`, one of its dependencies, its publisher account, or the referenced Skill repository. 2. The attacker publishes a malicious release or changes the repository content resolved by the unpinned identifier. 3. A user follows the documented installation command. 4. `npx` retrieves and runs the currently resolved CLI package, which then installs the currently resolved Skill content. 5. The malicious code executes with the privileges of the user running the command or is installed into the user's Agent environment. 6. Depending on those privileges, the payload could access user-readable files, alter Agent configuration, install additional malicious Skills, or execute other commands available to that user. ...[truncated 442 chars]
• Remediation: ## Remediation Suggestions 1. Pin the installer CLI to an explicitly reviewed version, for example by using a version-qualified npm package reference. 2. Pin the Skill source to an immutable commit hash or signed release rather than a mutable repository reference. 3. Publish and verify checksums or cryptographic signatures for released artifacts. 4. Use a lockfile and lock all transitive dependencies where the installation mechanism supports it. 5. Document how users can inspect the resolved package version and source revision before execution. 6. Recommend installation under a non-privileged account or in an isolated environment. 7. Avoid suggesting `sudo` or elevated execution for the installation command.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/validate_transition_event.py:112
• Finding: Policy-controlled regular expression permits validator denial of service## Vulnerability Details **File Location**: `scripts/validate_transition_event.py:112-123, 150-155` **Vulnerability Type**: Regular-expression denial of service **Risk Level**: Medium ### Vulnerable Code ```python pattern = policy.get("event_id_pattern") if not isinstance(pattern, str) or not pattern or len(pattern) > 256: errors.append( "policy event_id_pattern must be a string of 1-256 characters" ) else: try: re.compile(pattern) except re.error as error: errors.append(f"policy event_id_pattern is invalid: {error}") return errors ``` ```python event_id = event.get("id") id_pattern = policy.get("event_id_pattern", r"(?!x)x") if ( not isinstance(event_id, str) or re.fullmatch(id_pattern, event_id) is None ): errors.append("id does not match policy event_id_pattern") ``` ### Technical Analysis The policy validator accepts any syntactically valid Python regular expression up to 256 characters. A length limit on the pattern does not prevent expressions with nested or ambiguous quantifiers, such as `(a+)+$`, from exhibiting catastrophic backtracking. The event validator subsequently applies the policy-controlled expression to the event-controlled `id` using Python's backtracking `re` engine. No maximum length is imposed on the event ID, and no execution timeout or non-backtracking engine is used. An attacker who can supply or modify both the collaboration policy and a candidate event can therefore combine a pathological expression with a long, nearly matching ID. For example, `(a+)+$` applied to a long sequence of `a` characters followed by a nonmatching character can consume rapidly increasing CPU time. Policy validation must succeed before event validation in the command-line flow, but the malicious expression is syntactically valid and therefore passes the current policy checks. ### Attack Path 1. An attacker gains influence over a coll ...[truncated 1479 chars]
• Remediation: ## Remediation Suggestions 1. Prefer a fixed, code-defined event-ID grammar instead of accepting arbitrary policy-controlled regular expressions. 2. If customization is required, represent the ID format through constrained fields such as permitted prefixes, character sets, and numeric component lengths. 3. Enforce a conservative maximum length on `event["id"]` before performing pattern matching. 4. Reject constructs associated with catastrophic backtracking, including nested quantifiers and ambiguous quantified alternatives. Treat this only as defense in depth because reliably proving a backtracking expression safe is difficult. 5. Consider a non-backtracking regular-expression engine with guaranteed linear-time behavior. 6. Apply process-level CPU and wall-clock limits when validating untrusted input. 7. Add regression tests using pathological expressions and long near-matching IDs. 8. Document that policy files are security-sensitive configuration and must not be accepted from untrusted sources without independent validation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The invocation criteria are extremely broad and could cause the skill to activate in many normal workflows, including consequential or long-running operations. In this context, over-triggering is risky because the skill influences authority, control flow, monitoring, and handoff decisions; an unnecessary invocation could confuse ownership, expand process overhead, or be misused to justify operational control without a project-specific contract.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_validate_transition_event.py:27