Security audit

Bridle

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly a configuration manager, but it can install unpinned third-party components into trusted AI assistant configuration paths and overwrite existing setups.

Install only if you trust the Bridle publisher and the repositories you ask it to install. Prefer pinned versions or reviewed commits, avoid --force unless you have backups, and review any skills, agents, commands, or MCP configs before placing them in trusted assistant directories.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:12
Finding: Unpinned Third-Party Installation Sources
Content: View full analysis
Remediation: View remediation
--locked`. - Pin source installations to an immutable, reviewed commit rather than cloning and building the current default branch. - Publish cryptographic checksums or signatures for release artifacts and verify them before installation. - Pin the Homebrew formula or release artifact to a reviewed version with integrity verification. - Prefer reproducible builds and retain dependency lockfiles during installation. - Document the expected publisher identities and official distribution channels. - Re-audit the pinned release and its transitive dependencies before recommending it for automated installation. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:78
Finding: Unverified GitHub Components Installed into Trusted Agent Configuration
Content: View full analysis
``` The documented destinations include trusted harness configuration paths: ```markdown | Component | Claude Code | OpenCode | Goose | | --------- | ----------- | -------- | ----- | | Skills | `~/.claude/skills/` | `~/.config/opencode/skill/` | `~/.config/goose/skills/` | | Agents | `~/.claude/plugins/*/agents/` | `~/.config/opencode/agent/` | — | | Commands | `~/.claude/plugins/*/commands/` | `~/.config/opencode/command/` | — | | MCPs | `~/.claude/.mcp.json` | `opencode.jsonc` | `config.yaml` | ``` ### Technical Analysis The documented workflow permits components from a GitHub repository to be installed into directories trusted by AI coding assistants. No repository allowlist, immutable commit requirement, integrity check, publisher verification, staged content review, or explicit trust policy is documented. The `--force` option further permits existing installations to be overwritten. Depending on the component type and harness behavior, installed content may contain agent instructions, commands, skills, or MCP configuration that becomes active when the harness loads its configuration. This finding concerns the unsafe trust model documented by the skill. The audited artifact does not contain the Bridle implementation, so implementation-level controls such as path validation or confirmation prompts could not be verified. ### Attack Path 1. An attacker creates a malicious repository or compromises a repository that users already trust. 2. The attacker adds hostile skill instructions, agent definitions, commands, plugin cont ...[truncated 1127 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill documents commands that install components from GitHub, uninstall profiles, switch active profiles, and write configuration values across multiple AI assistant config locations, but it provides no warning that these actions modify local state and may overwrite or remove existing settings. In a skill context, users may invoke these commands with elevated trust, increasing the chance of unintended configuration changes or supply-chain exposure from third-party repos.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.