Security audit

war-room

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent decision-support workflow, but it asks for broad publishing, persistence, process orchestration, and permission-bypass behavior that users should review before installing.

Install only if you are comfortable with deliberation records being stored locally and potentially posted to GitHub Discussions using your gh credentials. Before use, disable or require explicit approval for discussion publishing, remove the --dangerously-skip-permissions alias/fallback guidance, avoid automatic repo-local script execution, and confirm where Strategeion data is retained and how to delete it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill’s stated purpose is deliberation and decision support, but it adds a default post-decision publishing workflow to GitHub Discussions. That expands the trust boundary from local analysis into external data exfiltration/publication, creating risk of leaking sensitive plans, architectural decisions, internal rationale, or stakeholder comments without an explicit opt-in.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Embedding `gh api graphql` discussion creation into a deliberation skill gives it an unnecessary outbound write capability unrelated to core reasoning. If invoked in a real environment, it could publish confidential decision records to a repository discussion board using existing CLI authentication, causing unauthorized disclosure or unwanted state changes.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The documentation explicitly references running `claude-glm --dangerously-skip-permissions`, which normalizes bypassing permission safeguards in a context that only requires strategic deliberation. This increases the chance that an agent or operator executes tools without guardrails, enabling unsafe filesystem, network, or system actions beyond the skill’s legitimate scope.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The module instructs automatic execution of a repository script to persist data, even though the parent skill is framed as deliberative decision support. Running repo-local code based on workflow state creates an unnecessary execution surface: a modified or malicious `scripts/deferred_capture.py` could write, transform, or exfiltrate decision data under the guise of routine capture.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The module documents session persistence and resume behavior, which expands the skill from pure deliberation into state retention. Storing deliberation artifacts can capture sensitive strategic context, and the file provides no clear consent, retention, or storage-boundary guidance, creating a real privacy and scope-expansion risk.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documentation introduces cleanup of team config and tmux panes, implying local process/session management beyond a deliberation-only skill. Even if framed as teardown, this operational capability affects host state and can surprise users or interfere with existing terminal workflows if invoked without explicit disclosure and confinement.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Tmux pane management is an operational control surface not obviously required for the stated purpose of strategic deliberation. Capabilities that create, modify, or destroy terminal session state can disrupt user environments and, in a broader agent framework, become a stepping stone for unauthorized workspace orchestration.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: This module materially expands the war-room skill from advisory deliberation into an action-taking publication workflow that writes persistent content to GitHub Discussions and updates local records. That creates a new exfiltration and repository-modification channel for potentially sensitive decision content, especially because publication is the default and includes cross-session discovery features.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The code adds repository content-management behaviors such as creating discussions, comments, labels, and updating metadata, which exceed the core purpose of decision support. In a security context, capability creep is dangerous because an agent that can publish and organize repository content can disclose internal strategy, create misleading authoritative records, or be abused to make unintended persistent changes.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The configuration includes a fallback command using `--dangerously-skip-permissions` for `field_tactician`, even though this skill is framed as a deliberation/orchestration tool rather than one that requires elevated execution bypasses. Embedding a permission-bypass default into expert invocation normalizes unsafe execution and can cause downstream tools to run without safeguards if this module is used in automation.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The GLM command resolver programmatically returns permission-bypassing invocations and even instructs users to create a persistent alias that always enables the bypass. This expands the unsafe behavior from a one-off command into a reusable execution pattern, increasing the chance that unrelated future tasks inherit unrestricted behavior.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The safety note claims agent-team invocation has 'no shell interpretation,' but the provided `tmux split-window` example passes a shell command string, which is then interpreted by a shell inside tmux. This mismatch can mislead maintainers into believing interpolation risks do not exist, potentially resulting in unsafe insertion of session IDs, names, or other dynamic values into shell-command contexts.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger list uses broad terms like deliberation, strategy, and decision-making, which can cause the skill to activate in many unrelated contexts. Because this skill includes persistence and optional external publication behaviors, over-broad triggering raises the risk of unintended invocation, unnecessary data retention, and accidental execution of higher-risk workflows.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill persists session artifacts to local storage in the Strategeion, but this retention behavior is not prominently disclosed up front. In a deliberation context, stored artifacts may include sensitive business decisions, architecture trade-offs, dissenting views, or internal analysis, so silent persistence creates confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The module explicitly directs automatic capture without warning the user that session IDs, decision rationales, dissenting views, and artifact paths will be written out. Silent persistence of potentially sensitive deliberation data reduces transparency and consent, and can cause unintended retention of internal strategy content.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The protocol states that sessions are persisted after each phase and that detailed session metrics are tracked, but it does not warn users about retention of deliberation artifacts. Because these artifacts may include sensitive problem statements, constraints, dissenting views, and strategic rationale, silent retention creates a meaningful confidentiality and transparency issue.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The cleanup section indicates manipulation of local team configuration and tmux pane state without user-facing warning. While lower impact than direct data exfiltration, undisclosed local environment changes can still disrupt user workflows, cause loss of in-progress terminal context, or violate expectations about the skill's scope.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The publishing flow sends detailed deliberation summaries, decision rationale, consequences, reversibility analysis, expert panel content, session identifiers, and local file path metadata to GitHub without a prominent privacy or sensitivity warning. This can leak confidential operational reasoning and internal filesystem structure to a broader audience, and the prior-publication default increases the likelihood of accidental disclosure.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The markdown presents dangerous permission-skipping flags as part of normal expert configuration without a strong warning, despite marking some experts as `dangerous`. In the context of a multi-LLM orchestration skill, this omission is especially risky because users may treat these definitions as approved defaults and enable broad unsandboxed execution unintentionally.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The installation guidance recommends adding a shell alias that permanently appends `--dangerously-skip-permissions`, creating a long-lived unsafe default for future invocations. Because aliases persist across sessions and contexts, this can silently weaken protections well beyond the war-room skill's intended use.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: ## Behavior Rules - Capture is automatic: do not prompt the user for confirmation. - Capture every qualifying COA in a single pass before closing the session.
Confidence: 88% confidence
Finding: do not prompt the user

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.