T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:220- Finding
Forced Publication of Project-Derived Information to an External Repository
- Content
View full analysis
- Remediation
View remediation
Security audit
workflow-improvement
Security checks for vulnerabilities and agentic risk
Overview
This workflow skill may be useful, but it needs review because it can publish workflow details and create persistent GitHub records without clear per-action confirmation.
Install only if you are comfortable with the agent reviewing workflow history and potentially writing persistent records. Before using it, require explicit approval for any git commit, GitHub issue, or GitHub Discussion post; preview the exact content; verify the destination repository and visibility; and redact private filenames, internal process details, stack traces, secrets, and repository-specific context.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
modules/auto-issue-creation.md:5- Finding
Deferred Project Information Is Published to GitHub Without Prior Approval
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:201- Finding
Workflow Automatically Stages and Commits Changes Without a Mandatory Review Gate
- Content
View full analysis
git commit -m "improve(sanctum): - Addresses recurring issue: Reduces by Evidence: stability_gap reduced from 0.35 to 0.12 Co-Authored-By: Claude Sonnet 4.5 " ``` ``` ### Technical Analysis The workflow directs the agent to stage and commit changes as part of its normal close-out procedure. It does not require a staged-diff review, explicit user approval, confirmation of the active branch, or validation that only intended files are staged. If `` is interpreted too broadly, or if the repository already contains staged content, the resulting commit can include unrelated or sensitive changes. A commit creates persistent repository history and may subsequently be pushed by another automated process. The fixed `Co-Authored-By` trailer is also not derived from the actual contributor identity. This can create inaccurate provenance metadata and may conflict with repository contribution policies. ### Attack Path 1. The skill modifies workflow-related files during its implementation step. 2. The working tree contains unintended modifications, or the Git index already contains unrelated staged content. 3. The agent follows the close-out instructions and runs `git add` without a mandatory allowlist or review. 4. The agent runs `git commit` without presenting the final staged diff for approval. 5. Unintended content becomes part of permanent local Git history. 6. A later push, CI process, or repository automation publishes or processes the commit. ### Impact Assessment The action uses the user’s local repository write permissions and Gi ...[truncated 492 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest frames the skill as a local workflow-improvement tool, but the body later expands behavior to include cross-repository publication to a fixed external project. That mismatch is dangerous because users may invoke the skill expecting local analysis only, while the skill can drive disclosure actions outside the stated scope, undermining informed consent and least surprise.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes broad, everyday terms like workflow, commands, agents, skills, hooks, confusing, and repetitive, which can cause accidental activation in many normal conversations. In this skill's context, unintended activation is more dangerous because the skill contains operational guidance, including external-posting behavior, so over-triggering increases the chance of unnecessary data handling or scope creep.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs the agent to post tooling learnings to a fixed external GitHub Discussions repository unrelated to the current working repo. This creates a data exfiltration and confidentiality risk because workflow summaries, repo-specific details, internal failures, or proprietary context may be disclosed to a third party without explicit user approval or sanitization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions direct posting learnings to an external GitHub Discussions site without a clear disclosure warning, approval checkpoint, or content-classification boundary. This is dangerous because users may unknowingly authorize sharing sensitive operational details, internal architecture, errors, or proprietary workflow information to a public or third-party location.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module adds an active side-effect capability—creating GitHub issues automatically—that goes beyond passive workflow evaluation and improvement guidance. Because it can transmit workflow-derived content to an external service and mutate project state without explicit, per-run user confirmation, it increases the chance of unintended data disclosure, issue spam, and unauthorized repository changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Enabling automatic GitHub issue creation 'by default' without an upfront warning or consent mechanism means workflow-derived data can be sent to GitHub unexpectedly. That creates privacy and compliance risk, especially when deferred items may contain internal code references, PR context, or operational details that users did not intend to publish or persist externally.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This section instructs the workflow to automatically create external GitHub issues for retrospective improvements, which is context-inappropriate for a workflow-improvement skill unless that behavior is prominently disclosed and authorized. In this context, the danger is elevated because retrospective content may include internal process details, filenames, or sensitive implementation notes that are pushed to GitHub automatically.
- Content
Static analysis
No suspicious patterns detected.