other
Warning
- Location
modules/insight-generation.md:7- Finding
Code-analysis evidence may be published externally without explicit user approval
- Content
View full analysis
- Remediation
View remediation
Security audit
code-refinement
Security checks for vulnerabilities and agentic risk
Overview
This code-refinement skill is mostly aligned with code-quality work, but it includes under-disclosed external posting and unsafe execution guidance that users should review before installing.
Install only if you want a code-quality skill that may perform broad repository analysis and, when explicitly invoked, modify files. Do not use the insight-generation module on private or sensitive repositories unless you first add an explicit approval, redaction, and destination check for GitHub posting, and avoid the scope-guard and stop-signal override behavior.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
modules/insight-generation.md:28- Finding
Untrusted finding data is interpolated into executable Python source
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest presents the skill as a code-quality analysis/refinement tool, but the body explicitly authorizes repository modification and execution of fixes. That mismatch can cause users or orchestration layers to invoke the skill under a lower-risk assumption than its real behavior, increasing the chance of unintended code changes.
- Content
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to suppress intermediate check-ins, persist through stop signals, and resume automatically until all actions are complete. In an agent setting, this is dangerous because it encourages bypassing harness/user control boundaries and can turn a bounded review into prolonged autonomous modification behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes broad terms like refactoring, clean-code, algorithms, craft, and anti-slop, which may cause activation in contexts where the user did not intend a repository-wide refinement workflow. Overbroad activation increases the chance that a powerful skill is selected inappropriately and begins scanning or planning edits on unrelated tasks.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This section narrows Steps 1-5 to planning, but the surrounding skill framing still markets the skill broadly as refinement without prominently disclosing that later steps can perform edits. The contradiction can mislead consumers, especially automated systems that classify skills from top-level descriptors rather than deep workflow text.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill discusses execution behavior deep in the workflow but does not surface an upfront warning that execution mode can modify repository files and continue across many findings. Users may reasonably interpret the skill as advisory only and be surprised by write actions once execution phrasing is matched.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The phrase 'ignore scope guard' explicitly disables branch-size or execution-limiting safeguards using a benign-sounding trigger. This weakens built-in containment controls and makes it easier for a user—or adversarial prompt chain—to coerce the agent into large, riskier modifications without normal safety boundaries.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module goes beyond local code-refinement analysis and instructs the agent to publish findings externally to GitHub Discussions. That creates an unintended data-exfiltration path for code-analysis details, repository structure, and potentially sensitive evidence without any explicit user approval or scoping controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill tells the agent to post findings to GitHub Discussions but does not warn that analysis content may be sent over the network and published externally. Because the evidence is expected to reference concrete code locations and recommendations, the module could expose sensitive internal details or security-relevant context without the user's informed consent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The posting capability is not necessary to achieve the stated purpose of improving code quality and therefore expands the skill's effective privileges without clear justification. Unnecessary outbound publication increases the chance that internal findings, code locations, or implementation details are disclosed to a broader audience.
- Content
Static analysis
No suspicious patterns detected.