feature-review

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:56 AM UTC
• Version: 1.9.19

Overview

The skill is mostly a feature-prioritization helper, but it tells the agent to automatically run a local Python script that could execute untrusted project code.

Review this skill before installing. The analysis and scoring parts are ordinary, but the deferred-capture step should be removed or changed to require explicit confirmation, use a trusted bundled helper, and pass arguments safely without shell interpolation. Be aware that GitHub issue creation and research enrichment can also touch external services when requested.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:233
• Finding: Automatic Execution of an Untrusted Repository-Relative Script## Vulnerability Details **File Location**: `SKILL.md`, lines 233-244 **Vulnerability Type**: Untrusted local tool execution through path resolution **Risk Level**: High ### Vulnerable Code ```markdown **Deferred capture for high-scoring suggestions:** After the user confirms which suggestions to act on, any high-scoring suggestion (score > 2.5) that is not acted on should be preserved as a deferred item. Run once per skipped high-scoring suggestion: ```bash python3 scripts/deferred_capture.py \ --title "<suggestion title>" \ --source feature-review \ --context "RICE score: <score>. <description>" ``` This runs automatically without prompting the user. ``` ### Technical Analysis The Skill instructs the Agent to execute `scripts/deferred_capture.py` automatically. That script is not included in the audited Skill package, and the command refers to it through a relative path. When the Skill runs from the target project's working directory, this relative path can resolve to a file controlled by that project. A malicious or compromised repository can therefore provide its own `scripts/deferred_capture.py`. The Skill's instruction to run the script automatically would cause that repository-controlled Python code to execute with the privileges of the Agent process. This behavior exceeds the minimum privileges needed for feature scoring and backlog review. Recording a deferred suggestion does not require executing arbitrary code supplied by the repository under review. ### Attack Path 1. An attacker creates or modifies a repository so that it contains a malicious `scripts/deferred_capture.py`. 2. The repository is submitted for feature review. 3. The Skill identifies a suggestion with a score greater than 2.5. 4. The user chooses not to act on that suggestion. 5. The Skill follows its automatic deferred-capture instruction. 6. `python3` resolves `scripts/deferred_capture.py` relative to the repository and executes the attacker's cod ...[truncated 937 chars]
• Remediation: ## Remediation Suggestions 1. Remove the instruction to execute the helper automatically. 2. Require explicit user approval after displaying the exact operation, destination, and data that will be written. 3. Bundle the helper inside the trusted Skill package rather than resolving it from the repository under review. 4. Resolve the bundled helper through a canonical absolute path rooted in the verified Skill installation directory. 5. Verify the helper's integrity before execution, such as through a package manifest or cryptographic hash. 6. Reject helper paths that resolve outside the trusted Skill directory, including through symbolic links. 7. Prefer a constrained file-write API over arbitrary Python execution when recording deferred suggestions. 8. Run any unavoidable helper in a sandbox with minimal filesystem access, no inherited secrets, and network access disabled unless strictly required.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:237
• Finding: Shell Command Injection Through Repository-Derived Suggestion Data## Vulnerability Details **File Location**: `SKILL.md`, lines 237-242 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash python3 scripts/deferred_capture.py \ --title "<suggestion title>" \ --source feature-review \ --context "RICE score: <score>. <description>" ``` ### Technical Analysis The command template interpolates a suggestion title, score, and description into a shell command. Titles and descriptions may be derived from repository documentation, backlog entries, issue text, or other attacker-influenced project content. Placing these values inside double quotes does not make shell interpolation safe. In common shells, command substitutions such as `$(command)` and backtick substitutions are evaluated inside double-quoted strings. An embedded double quote can also terminate the intended argument and expose subsequent shell metacharacters. The Skill does not require validation, escaping, or a structured process-execution API. Because deferred capture is described as automatic, a crafted repository-derived value may reach the shell without a user reviewing the resulting command. ### Attack Path 1. An attacker places crafted text in a feature name, backlog entry, or project documentation that the Skill will use as a suggestion title or description. 2. The text contains shell syntax, such as command substitution or a quote followed by shell operators. 3. The Skill scores the resulting suggestion above 2.5. 4. The suggestion is not selected for immediate action, triggering deferred capture. 5. The Agent substitutes the attacker-controlled text into the documented shell command. 6. The shell evaluates the injected syntax before or while launching Python. 7. The injected command executes with the Agent process's privileges. For example, a title containing shell command-substitution syntax could cause the shell to execute that substitution even though the title appears between double ...[truncated 650 chars]
• Remediation: ## Remediation Suggestions 1. Do not construct shell command strings from repository-derived content. 2. Invoke the helper through a structured process API that accepts an argument array and does not launch a shell. Conceptually, pass arguments as separate values: - `python3` - trusted absolute helper path - `--title` - title value - `--source` - `feature-review` - `--context` - context value 3. Treat titles, descriptions, and scores as untrusted data regardless of whether they were generated by the Agent. 4. Apply length limits and reject control characters before passing values to another process. 5. If structured process execution is unavailable, serialize the deferred item to a safely created JSON file and pass only a trusted file path to a verified helper. 6. Avoid relying solely on shell escaping, as correct escaping is shell- and platform-dependent. 7. Display the exact deferred item and require explicit confirmation before performing the write. 8. Add tests covering embedded quotes, dollar signs, command substitutions, backticks, newlines, semicolons, pipes, and redirection operators.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes generic terms like "roadmap," standalone methodology names like "RICE," "WSJF," and "Kano," and a broad natural-language phrase, which could overlap with ordinary product discussion rather than a clear request to invoke this skill. Although the document later describes when to use the skill, the trigger section itself does not provide tight activation constraints or negative examples to prevent unintended invocation.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document first states that GitHub issue creation requires user confirmation, then introduces an automatic deferred-capture action that runs without prompting the user. This inconsistency can mislead users and downstream agents into believing all write actions are consent-gated, when in fact a local write/command execution path is explicitly exempted.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to automatically execute a local Python script to persist deferred suggestions, creating a side effect outside the core review task. In a documentation-driven agent system, this expands capability from analysis into local code execution and file/data mutation without a fresh user confirmation, which is unsafe if the script, arguments, or environment are untrusted or have broader effects than described.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The deferred-capture behavior performs a write-oriented action via a local script without a clear warning or consent step at the point of execution. Because the skill is a prioritization tool rather than an execution tool, hidden or implicit data-writing behavior is more dangerous in context: users reasonably expect analysis, not autonomous local state changes.

Static analysis

No suspicious patterns detected.