Coding Pipeline

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:40 AM UTC
• Version: 1.0.1

Overview

This is mostly a coding workflow helper, but it recommends broad always-on hooks and persistent learning files that can influence future agent sessions.

Install only if you want this workflow to influence routine coding sessions. Prefer project-level hooks over user-level global hooks, narrow the matcher before enabling automatic reminders, and review any .learnings or workspace memory/rule updates before allowing them to persist.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The implemented script is a lightweight phase tracker and activity logger. It does persist phase state and log transitions, which is loosely related to a multi-phase pipeline, but it does not actually enforce the declared process. There is no logic to require the Plan→Code→Validate→Debug order, no semantic understanding of the phases, no retry counting, no escalation, and no safeguards against blind patching or symptom-fixing. The primary behavior is state/log management rather than workflow enforcement, so the description materially overstates what the code does.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

**Recommended Claude Code workflow:**

1. Install: copy the skill folder to `~/.claude/skills/coding-pipeline/`
2. Optional: enable the hook via `~/.claude/settings.json`
3. Start a task — Claude Code should invoke the skill automatically based on the description

## Codex CLI

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

**Recommended Claude Code workflow:**

1. Install: copy the skill folder to `~/.claude/skills/coding-pipeline/`
2. Optional: enable the hook via `~/.claude/settings.json`
3. Start a task — Claude Code should invoke the skill automatically based on the description

## Codex CLI

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

**Recommended Claude Code workflow:**

1. Install: copy the skill folder to `~/.claude/skills/coding-pipeline/`
2. Optional: enable the hook via `~/.claude/settings.json`
3. Start a task — Claude Code should invoke the skill automatically based on the description

## Codex CLI

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Memory Manipulation

High

• Category: Memory Poisoning

Content

#   phase-check.sh set <1|2|3|4>    — set current phase and log transition
#   phase-check.sh log <message>    — append a freeform log entry
#   phase-check.sh show             — print full activity log
#   phase-check.sh reset            — clear state (start of new task)

set -e

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest says the skill 'enforces' the pipeline and prevents retry loops, blind patching, and skipped phases. In the actual file, the content is descriptive instructions for an agent to follow, with no executable checks, state tracking, hooks, or mandatory control logic that would enforce compliance.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: This markdown file defines when the skill should activate, and the listed triggers cover very broad categories such as any bug report, feature request, refactor, or error investigation. Although a few exclusions are listed, the trigger scope remains expansive and lacks concrete negative examples for borderline cases, which could cause unintended invocation across routine development conversations.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Project-Level

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: This markdown file documents a hook configuration where `"matcher": ""` is used, which matches all prompts rather than a specific invocation scope. That is an ambiguous and overly broad trigger because it overlaps with all everyday user prompts and can cause unintended skill activation/reminder injection.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The file recommends placing the same empty-matcher hook in `~/.claude/settings.json`, which broadens activation from one project to every prompt in every project. Without specific trigger constraints or exclusions, this creates a vague global activation condition likely to invoke outside the intended context.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The Codex setup repeats the same `"matcher": ""` pattern, which means the reminder fires for every submitted prompt rather than a clearly defined subset. This lacks specificity on trigger scope and increases the chance of unintended reminder injection.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The file says the skill activates whenever a task description matches broad categories like bug, feature, refactor, or error investigation. These are common labels for everyday development work, but the document does not define clear boundaries or exclusions, which makes unintended invocation more likely.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The example configuration sets the hook matcher to an empty string, which does not communicate what prompts should or should not trigger the hook. This leaves activation behavior underspecified and risks applying the skill too broadly.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Manual:**

```bash
mkdir -p ~/.openclaw/workspace/skills/coding-pipeline
cp -r ./coding-pipeline/* ~/.openclaw/workspace/skills/coding-pipeline/
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The file directs escalation to `systematic-debugging`, including deeper instrumentation and parallel hypothesis testing via sub-agents, which expands capabilities beyond a bounded pipeline enforcer. This creates an unnecessary delegation channel that may expose project context, logs, or secrets to additional tools/agents without clear authorization or scope control.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The Phase 4 debugger guidance extends beyond bounded debugging into persistent cross-session knowledge capture by instructing writes to `.learnings/ERRORS.md`. That broadens the skill’s scope from process enforcement to memory accumulation, which can create unauthorized retention of sensitive error output, internal paths, stack traces, or user data across tasks and sessions.

Description-Behavior Mismatch

Low

• Confidence: 82% confidence
• Finding: The skill repeatedly presents itself as a strict process with bounded debugging and documented attempts, yet the attempt log may be written either to a file or merely inline in chat. That makes the core control optional and non-persistent, which does not match the strong claim of a disciplined enforced pipeline.

Scope Creep

Low

• Category: Excessive Agency

Content

- **In bounds**: `src/auth/middleware.ts`, `src/auth/session.ts`
- **Out of bounds**: anything in `src/features/`, any test file unrelated to auth, any dependency upgrade

If you find yourself wanting to edit an out-of-bounds file mid-Phase 2, **STOP** — that's scope creep. Either return to Phase 1 to expand scope with a reason, or leave it alone.

### 4. Success Criteria

• Confidence: 75% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

- **In bounds**: `src/auth/middleware.ts`, `src/auth/session.ts`
- **Out of bounds**: anything in `src/features/`, any test file unrelated to auth, any dependency upgrade

If you find yourself wanting to edit an out-of-bounds file mid-Phase 2, **STOP** — that's scope creep. Either return to Phase 1 to expand scope with a reason, or leave it alone.

### 4. Success Criteria

• Confidence: 75% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

- **In bounds**: `src/auth/middleware.ts`, `src/auth/session.ts`
- **Out of bounds**: anything in `src/features/`, any test file unrelated to auth, any dependency upgrade

If you find yourself wanting to edit an out-of-bounds file mid-Phase 2, **STOP** — that's scope creep. Either return to Phase 1 to expand scope with a reason, or leave it alone.

### 4. Success Criteria

• Confidence: 75% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.