Security audit

scope-guard

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a scope-control aid, but it should be reviewed carefully because it can push deferred work and detailed reasoning into GitHub by default.

Install only if you are comfortable with the skill influencing backlog workflow and GitHub project records. Before using it in a real repository, require explicit approval before every issue, Discussion, label, or comment write, review the exact destination and content, and avoid publishing branch names, roadmap details, customer information, security context, or internal deliberation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:151
Finding: Mandatory GitHub Issue Creation Causes Unauthorized External Side Effects
Content: View full analysis
" \ --source scope-guard \ --context "Worthiness: . . " \ --labels "deferred,scope-guard," ``` ``` `modules/github-integration.md:83-88`: ```markdown The deferral workflow requires this todo item: - `scope-guard:github-issue-created` - Mark complete ONLY after issue URL is confirmed This todo blocks marking `scope-guard:decision-documented` as complete. ``` `modules/github-integration.md:211-221`: ```markdown ## Failure Handling If issue creation fails: 1. **Retry once** with simplified body 2. **If still fails**, document in queue.md with full context 3. **Create issue manually** as soon as possible 4. **Never proceed** without documenting the deferral somewhere persistent ``` ### Technical Analysis The Skill is presented as a feature-worthiness and branch-scope evaluation mechanism, but its instruction ...[truncated 3093 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: modules/github-integration.md:107
Finding: Opt-Out GitHub Discussion Publishing Can Expose Detailed Internal Reasoning
Content: View full analysis
" \ -f body="$BODY" ``` ``` `modules/github-integration.md:147-181`: ```markdown **Discussion body structure:** ```markdown ## Deferred Feature: **Worthiness Score:** X.XX (threshold: 1.0) **Branch:** **Date:** **Linked Issue:** # ### Scoring Breakdown | Factor | Score | Rationale | |--------|-------|-----------| | Business Value | X | | | Time Criticality | X | | | Ri ...[truncated 3666 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger set includes broad, common terms such as 'scope' and 'prioritization', making accidental invocation likely in normal software conversations. Over-broad activation is risky here because the skill contains prescriptive workflow steps and external-action guidance, so it may steer unrelated sessions or push issue-creation behavior when not actually requested.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill’s stated purpose is scope scoring and branch-size enforcement, but it also requires creating GitHub issues and optionally Discussions whenever work is deferred. That expands the skill from analysis into external side-effecting actions, which can cause unintended publication of internal planning context, create workflow lock-in, and pressure an agent to perform repository operations beyond the user’s immediate intent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Mandating GitHub issue creation and defaulting toward Discussion publishing is not necessary to fulfill the declared function of evaluating scope and branch budget. This unnecessary capability increases the attack surface by enabling data exfiltration to external services, accidental disclosure of sensitive roadmap details, and unauthorized repository modifications under the guise of routine scope management.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: The skill describes autonomous execution before PR creation, including warning, blocking, and requiring justification, which gives the agent authority to alter or impede developer workflow without an immediate user decision. Even if configurable, this is risky because autonomous gating can be triggered inappropriately or be abused to create denial-of-workflow conditions.
Content: Scanner excerpt · modules/branch-management.md (reported line 87)May include surrounding context.
md
### Hook: pre-pr-scope-check Automatically runs before PR creation: 1. Check all threshold metrics 2. Warn on Yellow, block on Red (configurable) 3. Require justification for Red zone branches

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The self-invocation trigger is phrased broadly enough that normal discussion about branch growth or scope could cause the skill to activate outside a clearly bounded context. In an agent setting, ambiguous activation conditions can lead to unintended enforcement behavior, noisy interruptions, or repeated policy application that affects workflow without an explicit user request.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes a skill focused on scoring feature worthiness and enforcing branch-size limits against overengineering. These lines prescribe operational backlog-management actions—creating GitHub issues and updating queue.md—which go beyond evaluation and enforcement into project artifact management.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: A scope-guard skill would reasonably assess whether work belongs in the current branch, but directing users to create external GitHub issues introduces a separate issue-tracking capability. That capability may be useful, but it is not an obvious requirement of scoring feature worthiness or enforcing branch-size limits as described in the manifest.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This section expands a scope-management skill into publishing detailed internal deliberation to GitHub Discussions by default, including scoring rationale, alternatives, trade-offs, branch names, and contextual reasoning. That creates a real risk of oversharing sensitive internal planning, architecture rationale, roadmap signals, or security-relevant context to a broader audience than necessary, especially because publication is the default rather than an explicitly approved action.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Enabling publication of full reasoning context by default without a prominent disclosure warning is dangerous because users may unintentionally expose internal decision-making, backlog rationale, implementation constraints, or future plans. The risk is amplified by the prompt framing publication as the normal path and only treating refusal as an exception.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill instructs the agent to use GitHub GraphQL APIs to discover repository metadata and create Discussions, which are external state-changing operations beyond the core purpose of scoring scope worthiness. While not inherently malicious, these mutations increase the skill's authority and blast radius, and could lead to unnecessary repository changes or disclosure if executed in sensitive repos without tight approval boundaries.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.