T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:171- Finding
Mandatory Cross-Skill Delegation Redirects the User's Workflow Without Confirmation
- Content
View full analysis
- Remediation
View remediation
Security audit
project-brainstorming
Security checks for vulnerabilities and agentic risk
Overview
The skill is a legitimate brainstorming workflow, but it automatically expands into other skills, subagents, and file changes with limited user control.
Install only if you are comfortable with this skill saving project details locally and automatically handing the discussion to other attune skills or a review subagent. Use standalone or skip-review options where available, and do not run the deferred capture command with untrusted approach names or rationale text unless it is implemented without shell interpolation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
modules/deferred-capture.md:39- Finding
Shell Command Injection Through User-Controlled Deferred-Capture Fields
- Content
View full analysis
" \ --source brainstorm \ --context ". Not selected because: " ``` The `` should be a single sentence drawn from the approach's Pros list in the project brief. The `` should be the rejection reason recorded in Phase 5 under "Rejected Approaches". ``` ### Technical Analysis The command interpolates three values derived from project or user content directly into a shell command: - `` - `` - `` Double quotes do not prevent shell command substitution. For example, an approach name containing `$(command)` or backticks would be evaluated by a POSIX-compatible shell even when placed inside a double-quoted argument. Embedded quotation marks can also terminate the intended argument and introduce additional shell syntax. No escaping, strict validation, argument-array invocation, or shell avoidance is specified. The instruction therefore creates a command-injection path when an agent implements the command through a shell. The package does not contain `scripts/deferred_capture.py`, and the module instructs the agent to skip execution if the script is absent. Exploitation consequently requires such a script to exist in the working project and the user to explicitly approve deferred capture. These conditions reduce reachability but do not remove the unsafe command construction. ### Attack Path 1. An attacker or untrusted project document supplies an approach name, advantage summary, or rejection rationale containing shell syntax, such as `$(id)` or a quote followed by another command. 2. The malicious value is in ...[truncated 1029 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
modules/spec-review-loop.md:17- Finding
Untrusted Specification Content Is Dispatched to a General-Purpose Subagent and Used to Drive File Changes
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list uses broad everyday terms like 'planning' and 'requirements', which increases the chance of accidental activation in unrelated contexts. Because this skill can write files and auto-invoke additional phases, overbroad triggering materially raises the risk of unintended execution and data handling.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill presents itself as a brainstorming aid but embeds mandatory orchestration into other skills and phases, changing scope from advisory questioning to workflow automation. That creates a deceptive capability boundary and can cause unintended downstream actions or broader context propagation than a user would reasonably expect from the name/description alone.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Automatic transfer of all brainstorming context to another skill lacks a clear privacy warning or user-controlled consent boundary. Brainstorming data often contains sensitive product ideas, constraints, team details, or customer context, so silent forwarding expands exposure beyond the original interaction scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs creation of project artifacts and session files without a clear, prominent warning that local files will be created or modified. This can surprise users, overwrite existing content, or persist sensitive business ideas and stakeholder information to disk without informed approval.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The instruction to continue automatically and 'Do NOT prompt the user for confirmation' removes a meaningful consent checkpoint before invoking another phase. In a skill that writes files and chains into other skills, suppressing confirmation increases the likelihood of unauthorized or surprising autonomous actions.
- Content
md - `docs/project-brief.md` does not exist or is empty (phase failed) - User explicitly requests to stop after brainstorming **Do NOT prompt the user for confirmation** — this is a lightweight checkpoint, not an interactive gate. The user can always interrupt if needed. ### Phase 6.5: Spec Review Gate
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Phase 6.5 refers to a spec review loop using 'spec content' even though the described workflow has only produced a project brief. This workflow mismatch can cause the wrong document to be dispatched to another agent or prompt template, leading to unintended data exposure, incorrect automation, or unstable control flow.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 3. Main agent applies fixes to the spec document 4. Re-dispatch subagent with updated content 5. Repeat until approved or 3 iterations reached 6. After 3 iterations without approval, surface remaining issues to human ## Review Prompt Template
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill is documented as a questioning framework, yet it writes persistent artifacts such as docs/project-brief.md and session state files. Hidden persistence is risky because sensitive planning data may be stored locally without the user's informed consent or awareness of retention.
- Content
Static analysis
No suspicious patterns detected.