harden

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:40 AM UTC
• Version: 1.9.19

Overview

The skill is a coherent security-hardening assistant, but it can automatically post security audit summaries to a pull request without an explicit publication approval step.

Install only if you are comfortable with repository-wide security auditing and potential code/report changes under user-approved workflows. In PR environments, require manual review before any security summary is posted, especially for public repositories or private repos with broad PR access.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:168

Finding

Security findings may be disclosed through PR comments without an explicit publication approval gate

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:168-175
Vulnerability Type: External disclosure of sensitive audit results
Risk Level: Medium

Vulnerable Code

markdown

- Executive summary (SSDF practice coverage, CWE distribution)
- Findings table grouped by severity
- Per-finding detail: detection signal, citation, proposal, status
- Disposition table (applied / filed / deferred / rejected)
- Re-run instructions

If running inside a PR context, post the executive summary as a
comment via `abstract:post_review_insights`.

Technical Analysis

The Skill instructs the Agent to post a security-audit executive summary to a pull request whenever it detects a PR context. It does not require explicit user approval immediately before publication, display the exact outbound content, verify the destination repository and its visibility, or redact sensitive vulnerability information.

The hardening report can contain CWE classifications, severity levels, vulnerable file paths, detection signals, remediation status, and references to credential leaks. Even an executive summary can provide actionable information about unresolved weaknesses. Publishing this information is not necessary for the Skill's core local auditing and reporting functionality and therefore exceeds minimum privilege unless the user explicitly opts in.

The referenced abstract:post_review_insights implementation is not included in this artifact, so its authentication, destination validation, and redaction behavior could not be verified. No evidence was found that the Skill directly transmits credentials or file contents through the patterns flagged in modules/cross-cutting.md, modules/python-checks.md, or modules/nist-controls.md; those matches are detector documentation and citation data.

Attack Path

1. The Skill audits a repository in a pull-request context.
2. The audit identifies an unresolved vulnerability, credential exposure, or sensitive file path.

...[truncated 1496 chars]

Remediation

View remediation

Remediation Suggestions

1. Make all external posting explicitly opt-in, such as through a --post-summary option that defaults to disabled.
2. Require an interactive approval immediately before transmission, regardless of other auto-apply settings.
3. Display the exact destination, repository visibility, and complete outbound payload to the user before approval.
4. Generate a redacted publication summary that excludes secrets, exploit details, vulnerable code snippets, sensitive paths, and active credential indicators.
5. Post only after critical and high-severity findings have been remediated or the user explicitly accepts the disclosure risk.
6. Validate that abstract:post_review_insights targets the intended repository and pull request and uses minimum API permissions.
7. Record publication consent and the posted content in the local audit report without storing credentials.
8. Replace the current instruction with language such as:

markdown

If running inside a PR context, offer to post a redacted executive
summary. Do not invoke any external posting integration until the
user reviews the exact payload and explicitly approves its
destination. Never include secrets, exploit details, or sensitive
file contents.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list contains broad single-word activators such as 'security', 'python', 'rust', and 'cwe', which are likely to match many unrelated user requests. In an agent/plugin ecosystem, this can cause the hardening skill to activate unexpectedly and influence workflows outside the user's intent, increasing the chance of unnecessary repository scanning or proposal generation in security-sensitive contexts.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.

md

## Safety Rails

- **Never apply without approval.** Even with `--auto-apply`,
  CRITICAL findings always prompt.
- **One finding per commit.** Reversals are per-finding, not
  per-batch.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · modules/nist-controls.md (reported line 51)May include surrounding context.

md

| CWE-20 | Improper Input Validation | All |
| CWE-77 | Command Injection | All shell-out paths |
| CWE-287 | Improper Authentication | Auth layer |
| CWE-269 | Improper Privilege Management | Container, sudo |
| CWE-502 | Deserialization of Untrusted Data | Python, Java |
| CWE-200 | Exposure of Sensitive Information | Logs, errors, telemetry |
| CWE-863 | Incorrect Authorization | Web layer |

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · modules/python-checks.md (reported line 26)May include surrounding context.

md

| PY05 | SQL injection via string formatting | CWE-89 | PW.5.1 | `cursor.execute(f"...")` or `% ` formatting in a query |
| PY06 | Path traversal in user-supplied paths | CWE-22 | PW.5.1 | `open(user_input)` without `Path.resolve()` and `is_relative_to()` |
| PY07 | Insecure RNG used for security purposes | CWE-330 | PW.5.1 | `import random` then a token/secret/key generated from it; should be `secrets` |
| PY08 | TLS verification disabled | CWE-295 | PW.9 | `requests.*(verify=False)`, `ssl.CERT_NONE`, `disable_warnings(InsecureRequestWarning)` |
| PY09 | Hardcoded credentials | CWE-798 | PW.5.1 | regex match for `api[_-]?key`, `secret`, `token`, `passwd` literals; AWS prefixes (`AKIA...`) |
| PY10 | Subprocess invocation without timeout | CWE-400 | PW.5.1 | `<child-proc>.run/Popen` without `timeout=` |
| PY11 | Tarfile extraction without member filter | CWE-22 | PW.9 | `tarfile.*extractall(` without `filter=` (PEP 706; default became safe in 3.12+) |

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: modules/cross-cutting.md:26