tiered-audit

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:49 AM UTC
• Version: 1.9.19

Overview

The skill is a disclosed code-audit workflow with proportionate repository reads and local findings files, but users should invoke it intentionally because its triggers and shell examples are broad.

Install only if you want an audit workflow that may inspect repository history and selected source areas and create .coordination findings files. Invoke it intentionally, validate any base revision before running the shown git commands, and treat repository-provided instruction files as untrusted context.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: modules/tier2-targeted.md:20

Finding

Repository-Controlled Instructions May Hijack the Tier 2 Audit

Content

View full analysis

Vulnerability Details

File Location: modules/tier2-targeted.md:20-21
Vulnerability Type: Indirect prompt injection through untrusted repository context
Risk Level: Medium

Vulnerable Code Snippet:

markdown

1. Load the area context from plugin CLAUDE.md and
   skill descriptions

Technical Analysis

The Tier 2 execution protocol instructs the Agent to load CLAUDE.md and Skill descriptions from the area being audited. These files can be controlled by the owner of the target repository and may contain arbitrary natural-language instructions.

The protocol does not establish a trust boundary requiring repository content to be treated only as untrusted evidence. It also does not direct the Agent to ignore embedded tool requests, role changes, output constraints, or attempts to override the audit procedure. If the runtime interprets loaded repository content as operative instructions, a malicious repository can indirectly inject instructions into the Agent's active context.

Attack Path

1. An attacker adds a malicious CLAUDE.md or Skill description to the repository.
2. The file includes instructions that attempt to override the audit, such as suppressing findings, reading unrelated files, invoking tools, modifying artifacts, or disclosing available information.
3. Tier 1 flags the affected area for targeted review.
4. During Tier 2, the Agent follows the protocol and loads the attacker-controlled file as context.
5. Because the protocol does not require strict separation between repository data and trusted Skill instructions, the Agent may follow the injected directives.
6. Any resulting actions execute within the permissions and tool access available to the auditing Agent.

Impact Assessment

Successful exploitation can alter the audit's goals, conceal vulnerabilities, falsify findings, or redirect the Agent toward unrelated tool operations. The maximum privilege available is bound ...[truncated 286 chars]

Remediation

View remediation

Remediation Suggestions

• Explicitly classify all repository files, including CLAUDE.md and Skill descriptions, as untrusted input.
• Instruct the Agent to analyze their contents as evidence only and never follow instructions found in them.
• Require the Agent to ignore embedded role changes, tool requests, output-format overrides, safety-policy changes, links, and requests to access unrelated resources.
• Prefer extracting only narrowly defined metadata instead of loading entire instruction-oriented files into the active instruction context.
• Preserve trusted audit instructions in a higher-priority context that repository content cannot override.
• Record and report detected prompt-injection text rather than executing it.
• Run audits with least-privilege filesystem, command, and network permissions to limit the impact of any successful injection.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:54

Finding

Unvalidated Git Base Value Is Interpolated into Shell Commands

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:54-75
Vulnerability Type: OS command injection through an unquoted revision placeholder
Risk Level: Medium

Vulnerable Code Snippet:

bash

# 1. Churn hotspots: files changed most often
git log --format="" --name-only {base}..HEAD \
  | sort | uniq -c | sort -rn | head -20

# 2. Diff stats: size of changes per file
git diff --stat {base}..HEAD

# 3. Fix-on-fix patterns: commits fixing previous commits
git log --oneline {base}..HEAD \
  | grep -iE "(fix|revert|patch|hotfix)"

# 4. New file clusters: modules with many new files
git diff --name-status {base}..HEAD \
  | grep "^A" | cut -f2 \
  | sed 's|/[^/]*$||' | sort | uniq -c | sort -rn

# 5. Large commits: single commits with big diffs
git log --format="%h %s" --shortstat {base}..HEAD

Technical Analysis

The Skill places the {base} placeholder directly into multiple shell command examples without defining validation, safe quoting, or argument-oriented execution requirements. If an implementation obtains this value from user input, repository metadata, automation parameters, or another untrusted source and performs direct textual substitution, shell metacharacters can alter the command structure.

For example, a value containing command separators, substitutions, redirections, or additional pipeline syntax could cause the shell to execute operations beyond the intended Git query. Git revision syntax should be validated independently and passed as one argument rather than interpolated into a shell program.

The issue is conditional on the documented commands being executed through a shell with an attacker-influenced {base} value. A fixed, internally generated, and validated revision would not expose the injection path.

Attack Path

1. An attacker influences the base revision supplied to the audit, such as through an API parameter, automation input, or prompted branch selectio ...[truncated 883 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct shell command strings by substituting {base}.

• Resolve the requested revision before use, for example with:

  bash

  git rev-parse --verify --end-of-options "$base^{commit}"
  

• Reject the value if revision resolution fails.

• Where feasible, restrict accepted values to a conservative allowlist of full commit hashes or known local branch names.

• Construct the revision range as a single argument and invoke Git without a shell, for example through an argument array equivalent to:

  text

  ["git", "diff", "--stat", "--", validated_range]
  

• If a shell is unavoidable, pass the validated range through a positional parameter rather than concatenating it into shell source.

• Use --end-of-options where supported to prevent revision values from being interpreted as command-line options.

• Document that base revisions must never be accepted as raw shell fragments and must not contain metacharacters.

• Execute audit commands with least privilege and without unnecessary credentials or network access.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 95% confidence

Finding

The trigger "review" directly overlaps with a common built-in command, creating a shadow-command condition where this skill may intercept requests intended for native review functionality. In practice, that can alter execution flow, produce unexpected file-writing behavior, and bypass the user's expectation of which tool or workflow is being invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list includes broad, generic phrases such as "audit," "review," and "code-quality," which can cause the skill to activate in situations not specifically requesting this workflow. Because the skill performs multi-step audit behavior and instructs writing coordination artifacts, unintended invocation could lead to confusing behavior, incorrect task routing, or unnecessary repository inspection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.