Security audit

agent-orchestra

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent multi-agent orchestration guide, but its included workflow can fetch arbitrary URLs and rewrite artifacts by default, so users should review its scope before installing.

Install only if you are comfortable with a skill that may coordinate multiple agents, render files or URLs, and in fix mode generate revised artifacts. Prefer review mode by default, restrict network access or allowlist URL origins, run it in a disposable workspace without ambient browser credentials, and pin or verify the installation source rather than using the unpinned npx command.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.md:83
Finding: Unpinned Package Execution in the Recommended Installation Command
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: examples/saturating-review-engine.workflow.js:186
Finding: Unrestricted URL Ingestion Can Trigger Server-Side Request Forgery
Content: View full analysis
[ 'You are the INGEST node of a review graph. Render the artifact for both textual and VISUAL review.', 'Artifact path: ' + path + ' (could be a PDF, .md/.html, .pptx/.key, an image set, or a URL — detect and adapt).', 'Do ALL of this with bash and save outputs under a sibling _review_assets/ directory:', ' 1. Produce a plain-text extraction (pdftotext / pandoc -t plain / strip HTML) at text_path.', ' 2. Produce one PNG per page or screen (pdftoppm -png, or render md/html via a headless browser or pandoc+weasyprint, or screenshot the URL). Return their absolute paths in page order.', ' 3. Run a DETERMINISTIC surface-defect scan over the text with grep -nE for: \\[insert[^]]*here\\], \\[TODO\\], TKTK, lorem ipsum, \\?\\?, Figure \\?, Table \\?, \\\\ref|\\\\cite (unrendered LaTeX), citation needed, [object Object], undefined. Record every hit as {page, pattern, snippet}.', 'Return the manifest. Do not review anything — just render and scan.', ].join('\n') ``` ### Technical Analysis The workflow places the caller-controlled `args.artifactPath` value into a prompt and explicitly directs an autonomous agent to treat it as a URL when applicable. The agent is instructed to use Bash and a headless browser or screenshot mechanism to retrieve and render that URL. No controls restrict: - Permitted URL schemes - Destination hostnames or ports - Loopback, private, link-local, or reserved IP ranges - Cloud instance metadata addresses - DNS rebinding - Redirects to prohibited destinations - Network egress from the rendering environment Because the request originates from the workflow host rather than the external caller, it can potentially reach resources that are inaccessible ...[truncated 1794 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose is about orchestrating multi-agent workflows and graph composition. The actual code does not implement agent orchestration, graph design, arbitration, review loops, or any runtime adapter behavior. Instead, it performs dependency-free structural checks for the public repository, including required file presence, metadata validation, and regex-based leak detection. These are materially different capabilities and indicate the code chunk serves repository QA/compliance rather than multi-agent composition.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The playbook instructs the agent to create or use git repositories and branches and to commit all outputs, but it does not require explicit user consent or warn that this changes the user's repository state. In an agent skill, that omission can lead to unintended branch creation, commits, or repository initialization in the user's workspace, which is a meaningful integrity and workflow risk even if not directly code-execution related.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The ingest prompt explicitly allows treating the artifact path as a URL and rendering it with a headless browser. That expands the workflow from passive graph composition into active network-capable content fetching and browser execution, which can expose the runtime to SSRF, internal network access, or untrusted web content processing if callers control artifactPath.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The rewrite stage instructs agents to copy sources, edit them, rebuild the artifact, and feed the modified result back into the loop. This gives the workflow autonomous file-modification behavior beyond orchestration, and if inputs or tool permissions are broad it can lead to unintended source changes, tampering with local content, or unsafe build execution on untrusted material.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This markdown file documents an optional rewrite stage and states that the default mode is fix, which can produce a revised copy of an artifact. Although it notes that review should be chosen when edits are not authorized, the README does not give a clear user warning near installation or invocation that the skill may modify user artifacts by default.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill manifest emphasizes designing and composing multi-agent graphs across runtimes, with the JavaScript workflow framed as just one adapter. This file's main execution path is an end-to-end artifact processing pipeline that ingests files/URLs, runs review agents, and rewrites outputs over multiple rounds, which is materially more operational than the high-level orchestration description suggests.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.