Multi-Agent Parallel Build

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:18 PM UTC
• Version: 1.0.0

Overview

This skill is a transparent guide for coordinating parallel coding agents, with some operational risks users should manage during review and integration.

Install only if you want workflow guidance for coordinating several coding agents at once. Before using it on important repositories, require separate branches or worktrees, non-overlapping file ownership, diff review, tests, and pinned or vendored frontend dependencies for generated pages.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/wave-planning.md:30
• Finding: Unpinned Third-Party JavaScript Loaded from an External CDN<![CDATA[ ## Vulnerability Details **File Location**: `references/wave-planning.md`, line 30 **Vulnerability Type**: Unpinned executable third-party dependency without integrity verification **Risk Level**: Medium ### Vulnerable Code ```markdown - Use Chart.js for charts (CDN: https://cdn.jsdelivr.net/npm/chart.js) ``` ### Technical Analysis The agent prompt template directs generated pages to load Chart.js from a versionless jsDelivr URL. Because no exact package version is specified, the JavaScript returned by this URL can change after the Skill has been reviewed. The recommendation also provides no Subresource Integrity hash, so browsers cannot verify that the downloaded script matches a previously audited artifact. This template is intended to be passed to multiple coding agents. Consequently, agents following it may repeatedly embed the mutable dependency into generated pages, propagating the supply-chain weakness across multiple project outputs. Exploitation requires the external package distribution path to return malicious or compromised content. This could result from compromise of the upstream package or CDN, unauthorized publication, or an unexpected change to the version resolved by the unpinned URL. ### Attack Path 1. A coding agent receives the prompt template from `references/wave-planning.md`. 2. The agent generates an HTML page that loads `https://cdn.jsdelivr.net/npm/chart.js`. 3. A user opens the generated page, causing the browser to retrieve executable JavaScript from the external CDN. 4. The CDN or upstream package distribution path supplies altered or malicious content. 5. Because the dependency is not pinned and no integrity hash is enforced, the browser accepts and executes the changed script. 6. The script runs within the generated page's browser context and can manipulate the interface, read data accessible to page JavaScript, and issue network requests allowed by browser security controls. ### Impact Assessment A compromis ...[truncated 672 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin Chart.js to an explicitly reviewed version rather than relying on an unversioned URL: ```html <script src="https://cdn.jsdelivr.net/npm/chart.js@<audited-version>/dist/chart.umd.min.js" integrity="sha384-<verified-hash>" crossorigin="anonymous"></script> ``` 2. Obtain the integrity hash from a trusted source or generate and verify it against the reviewed artifact. Update the pinned version and hash only through a controlled dependency-review process. 3. Prefer vendoring the audited JavaScript asset in the project and serving it locally when deployment and licensing requirements permit. 4. Configure a restrictive Content Security Policy that limits script sources to explicitly approved origins and avoids `unsafe-inline` and `unsafe-eval`. 5. Add automated checks that reject versionless CDN package URLs and external scripts without integrity metadata. 6. Update the agent prompt template so all spawned agents receive the secure, version-pinned dependency requirement and do not recreate the unsafe pattern. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly instructs spawning multiple coding agents in parallel and provides operational guidance, but it does not include safeguards such as mandatory human review, isolated branches/workspaces, or explicit warnings about concurrent modifications before changes are merged. In a coding-agent environment, this can lead to conflicting edits, accidental overwrites, or unreviewed code being introduced at scale, increasing the chance of security regressions or supply-chain style mistakes.