Security audit

agent-orchestra

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a disclosed multi-agent workflow guide, but it includes under-scoped instructions that can trigger destructive file operations and unsafe processing of user-controlled artifacts.

Install only if you are comfortable supervising a high-authority orchestration guide. Use review mode unless edits are intentional, run examples only in a disposable sandbox with no sensitive credentials, avoid URL inputs unless explicitly needed, and replace the destructive workspace template with a validated temporary directory workflow before using it for code changes.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: README.md:80
Finding: Mutable and Unpinned Installation Chain## Vulnerability Details **File Location**: `README.md:80-84` **Vulnerability Type**: Supply-chain exposure through an unpinned executable installer and mutable repository reference **Risk Level**: Medium ### Vulnerable Code ```sh npx skills add AntreasAntoniou/agent-orchestra ``` ### Technical Analysis The documented installation procedure invokes `npx` without pinning the `skills` package to a reviewed version. Depending on the local npm configuration and cache, `npx` may retrieve and execute the latest available version of that package. The Skill is also identified by a repository owner and repository name without a commit hash, signed release, immutable tag, or integrity digest. Consequently, the effective installation chain contains two mutable components: 1. The executable `skills` package resolved by `npx`. 2. The repository content retrieved by that installer. The repository itself does not contain an embedded malicious installer, and the audit found no evidence that the current upstream content is malicious. The vulnerability is that the documented command does not ensure that users receive the same code that was audited. ### Attack Path 1. An attacker compromises the npm package, package publisher account, repository account, or another relevant upstream distribution component. 2. The attacker publishes a modified installer or changes the repository content resolved by the unpinned reference. 3. A user follows the documented `npx skills add AntreasAntoniou/agent-orchestra` instruction. 4. `npx` downloads and executes the mutable installer, which then retrieves mutable Skill content. 5. Attacker-controlled installation logic or Skill instructions run with the permissions of the invoking user or agent host. ### Impact Assessment Successful exploitation could install attacker-controlled Skill instructions or execute malicious installer behavior with the invoking user's permissions. Depending on the host ...[truncated 353 chars]
Remediation: ## Remediation Suggestions 1. Pin the executable installer to an audited version, for example by using an explicit npm package version. 2. Pin the Skill source to an immutable commit hash or cryptographically verified release. 3. Publish expected SHA-256 digests for release artifacts and document how users can verify them before installation. 4. Prefer signed tags or release attestations where the distribution platform supports them. 5. Provide a non-executing manual installation alternative that downloads a fixed archive, verifies its digest, and then copies the reviewed files. 6. Document the exact installer version and repository revision tested by maintainers. 7. Avoid presenting mutable branch references as equivalent to reviewed releases.

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:318
Finding: Unvalidated Recursive Deletion in Mandatory Shell Template## Vulnerability Details **File Location**: `SKILL.md:318-320` **Vulnerability Type**: Unsafe shell variable expansion and destructive filesystem operation **Risk Level**: High ### Vulnerable Code ```sh rm -rf $WORKDIR && git clone -q $SOURCE $WORKDIR && cd $WORKDIR ``` The command is introduced as a mandatory part of the implementer brief: ```text Implementer brief must: rm -rf $WORKDIR && git clone -q $SOURCE $WORKDIR && cd $WORKDIR; a SANDBOX RULE forbidding any path outside $WORKDIR; touch only item.files; set up a venv + run the full suite; return git add -A && git diff --cached. ``` ### Technical Analysis The template performs recursive deletion before verifying that `WORKDIR` is nonempty, canonical, located under an approved disposable directory, or free of symbolic-link and path-manipulation issues. Both `WORKDIR` and `SOURCE` are expanded without shell quoting. Unquoted expansion permits shell word splitting and pathname expansion. A malformed or attacker-influenced value can therefore be interpreted as multiple arguments, wildcard expressions, or command options rather than one literal path. Examples of unsafe states include: - `WORKDIR` being empty or incorrectly initialized. - `WORKDIR` resolving to a sensitive directory rather than a disposable workspace. - `WORKDIR` containing spaces or wildcard characters. - A value beginning with `-` being interpreted as an option. - `SOURCE` or `WORKDIR` being split into unintended `git clone` arguments. - A race or symbolic-link manipulation redirecting operations away from the expected temporary directory. The later textual sandbox rule does not protect against the initial `rm -rf` command because deletion occurs before the new workspace is cloned and entered. ### Attack Path 1. A task definition, environment setup, prompt-generated script, or orchestration wrapper supplies an unsafe `WORKDIR` or `SOURCE` va ...[truncated 1215 chars]
Remediation: ## Remediation Suggestions 1. Do not delete a caller-supplied path. Create a unique workspace with `mktemp -d` and retain the generated path. 2. Quote every variable expansion: ```sh git clone -q -- "$SOURCE" "$WORKDIR" cd -- "$WORKDIR" ``` 3. Before any cleanup, reject empty paths and canonicalize the workspace with `realpath`. 4. Require the canonical path to be a child of a dedicated directory such as `/tmp/agent-orchestra/`. 5. Explicitly reject `/`, `.`, `..`, the current repository, the user's home directory, and paths outside the approved temporary root. 6. Use `--` to terminate option parsing where the command supports it. 7. Create workspaces with restrictive permissions and avoid predictable names. 8. If cleanup is necessary, track the exact directory created by the current process and remove only that directory after revalidating its canonical path. 9. Perform destructive cleanup in a host-enforced sandbox rather than relying solely on prompt instructions. 10. Add automated tests covering empty variables, whitespace, wildcard characters, leading hyphens, symbolic links, and paths outside the temporary root.

T09 · Insecure Skill Coding Practices

Error

Location: examples/saturating-review-engine.workflow.js:169
Finding: Untrusted Paths, URLs, and Artifact Content Cross Tool-Execution Boundaries## Vulnerability Details **File Location**: `examples/saturating-review-engine.workflow.js:169-181` **Additional Locations**: `examples/saturating-review-engine.workflow.js:183-189`, `250-257`, `290-325` **Vulnerability Type**: Missing validation and isolation for shell-processed artifacts, URLs, generated paths, and prompt-controlled content **Risk Level**: High ### Vulnerable Code ```js const ingestPrompt = (path) => [ 'You are the INGEST node of a review graph. Render the artifact for both textual and VISUAL review.', 'Artifact path: ' + path + ' (could be a PDF, .md/.html, .pptx/.key, an image set, or a URL — detect and adapt).', 'Do ALL of this with bash and save outputs under a sibling _review_assets/ directory:', ' 1. Produce a plain-text extraction (pdftotext / pandoc -t plain / strip HTML) at text_path.', ' 2. Produce one PNG per page or screen (pdftoppm -png, or render md/html via a headless browser or pandoc+weasyprint, or screenshot the URL). Return their absolute paths in page order.', ' 3. Run a DETERMINISTIC surface-defect scan over the text with grep -nE for: \\[insert[^]]*here\\], \\[TODO\\], TKTK, lorem ipsum, \\?\\?, Figure \\?, Table \\?, \\\\ref|\\\\cite (unrendered LaTeX), citation needed, [object Object], undefined. Record every hit as {page, pattern, snippet}.', 'Return the manifest. Do not review anything — just render and scan.', ].join('\n') ``` Untrusted manifest paths are subsequently passed to agents: ```js const dimPrompt = (rev, dim, manifest, variant) => [ 'You are reviewer "' + rev.id + '", dimension "' + dim.key + '", independent draft ' + variant + '.', 'PERSONA: ' + rev.persona, 'DIMENSION CONSTRAINT: ' + dim.brief, 'Read the extracted text at ' + manifest.text_path + '. A deterministic pre-scan already flagged these surface defects (treat as ground truth, do not re-litigate their existence): ' + JSON.stringify(manifest.surface_defects), 'List ...[truncated 5086 chars]
Remediation: ## Remediation Suggestions 1. Accept local artifacts only from an explicitly configured workspace root by default. 2. Canonicalize every local path and reject paths outside that root, including symbolic-link escapes. 3. Store all generated assets in a workflow-created directory with a random name and restrictive permissions rather than an arbitrary sibling directory. 4. Validate `text_path`, every `image_paths` entry, and `new_artifact_path` after each agent response. Require them to resolve beneath the current workflow directory and correspond to regular files created during the current run. 5. Do not ask a language-model agent to construct shell commands from raw input. Use a deterministic host-side renderer with argument arrays rather than shell interpolation. 6. If URL review is required, allow only `https` and enforce an origin allowlist. Resolve DNS before each request and block loopback, private, link-local, multicast, and cloud metadata ranges for both IPv4 and IPv6. 7. Revalidate redirect destinations and protect against DNS rebinding. 8. Disable network access entirely when reviewing local artifacts. 9. Run parsers and browsers in a disposable container or sandbox with no host credentials, read-only source mounts, a dedicated writable output mount, resource limits, and restricted syscalls. 10. Delimit artifact content as untrusted data in every prompt and explicitly instruct agents never to follow commands or tool-use requests contained in the artifact. 11. Separate content extraction from agent reasoning so review agents receive content but do not receive general-purpose shell access. 12. Replace agent-selected output paths with opaque workflow-issued artifact identifiers. 13. Verify the selected rewrite by file identity, ownership, creation time, digest, and containment before re-ingestion. 14. Add adversarial tests for prompt injection, path traversal, symbolic links, URL redirects, private IP addresses, metadata endpoints, ...[truncated 47 chars]

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The README states that the default mode is `fix`, which can modify artifacts unless the user explicitly opts into `mode: "review"`. In a skill whose purpose is orchestrating multi-agent workflows, this creates a realistic risk of unintended file changes or broad edit authorization if a user assumes review-only behavior from the example or invokes it without carefully setting mode.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The ingest prompt authorizes shell-based rendering, format conversion, and screenshotting of a user-provided artifact path that may be a local file or a URL. In this skill context, that can trigger subprocess execution and outbound network access against attacker-influenced inputs, creating SSRF, unintended local file processing, and risky parsing of untrusted documents without any explicit allowlist, sandbox, or user disclosure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.