Agent Coordination

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:59 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a disclosed agent-coordination workflow, but it needs review because it can keep a persistent coordination mode, create tasks, launch coding agents, and inspect CI logs with limited scoping.

Install only if you want the assistant to coordinate VibeKanban tasks and potentially start coding-agent workspace sessions. Before using it, confirm the project, repository, branch, executor, and any task deletion or CI log inspection; explicitly exit CoS mode when done, and do not rely on the hard-coded local repository exception.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:14

Finding

Persistent Agent Role and Execution-Policy Hijacking

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is agent coordination, but the skill also instructs operational behavior like CI polling, status retrieval, and log inspection. This mismatch can mislead operators about the true capability surface, causing them to authorize or invoke a skill with broader access than expected.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file's behavior does not match the declared skill purpose of agent coordination and instead performs GitHub PR CI inspection with optional failed-log retrieval. This capability mismatch is dangerous because it hides repository/CI data access inside an unrelated skill, increasing the chance of unintended invocation, overbroad permissions use, and covert data exposure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill references shell-capable behavior such as running git and CI-monitoring scripts, but it does not declare an explicit tool scope or allowed-tools boundary. In an agent setting, undocumented execution capability increases the risk of unexpected command execution and makes it harder for users or policy layers to constrain what the skill can do.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list includes common conversational variants like 'be my cos' or 'act as cos,' which are prone to accidental matches in normal dialogue. Because the skill's mode is persistent, a casual phrase could unintentionally switch the assistant into a task-delegation workflow for the rest of the conversation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes common conversational variants like 'be my cos' or 'act as cos,' which are prone to accidental matches in normal dialogue. Because the skill's mode is persistent, a casual phrase could unintentionally switch the assistant into a task-delegation workflow for the rest of the conversation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill says CoS mode persists for the entire conversation and that subsequent requests are transformed into task delegations. Persistent session-level role changes are risky because a single triggering phrase can silently affect later unrelated requests, increasing the chance of unintended task creation or tool use.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

User: "you're my cos. remove all lovable mentions"

WRONG: "Let me search for lovable mentions..." [executes directly] RIGHT: "I'll create a task for this. Which project should I use?"

text

## Role Definition

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Contradictory instructions about whether the agent may edit code create an unsafe ambiguity in enforcement. When a skill both forbids and permits coding depending on a buried exception, the more permissive interpretation can win during execution, undermining user expectations and policy checks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states the coordinator must not write or edit code, then grants a blanket exception for full autonomy in a specific local repository. That exception silently bypasses the role safety boundary and could enable unrestricted code changes in a sensitive local path without fresh user approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document exposes a destructive delete_task capability and shows direct usage without any warning, confirmation guidance, soft-delete semantics, or discussion of recovery limitations. In an agent-coordination skill, this is more dangerous because users or autonomous agents may invoke task deletion as part of workflow cleanup, causing accidental loss of project planning data, audit history, or in-flight coordination state.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/monitor-pr-ci.py (reported line 63)May include surrounding context.

python

def run_gh(args: list[str]) -> tuple[int, str, str]:
    """Run a gh CLI command."""
    try:
        result = subprocess.run(
            ["gh"] + args,
            capture_output=True,
            text=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script goes beyond status monitoring and fetches then prints failed GitHub Actions logs. CI logs often contain sensitive build output, internal paths, stack traces, tokens accidentally echoed by jobs, or other secrets, so displaying them to any caller of the skill can expose information outside the minimum needed purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s activation text contains many broad natural-language triggers such as “act as cos,” “be my cos,” and “you are my chief of staff,” which can match ordinary conversation rather than a deliberate request to invoke this skill. In an agent-orchestration skill, accidental activation is more dangerous because it can shift the assistant into persistent delegation behavior, influence later turns, and potentially cause unintended use of external tools or scripts described by the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill hard-codes a user-specific local filesystem path and grants special autonomy there without documenting why that location is safe or who authorized it. Embedding a privileged path in reusable skill content creates a risk of unintended access to local code and leaks environment-specific assumptions into agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file includes an implementation plan that explicitly instructs changing .env.example and .env.local, which can affect local credentials or developer configuration. The surrounding guidance does not warn that environment-file edits may impact secrets or local setup, so the behavior could affect user data/system integrity without disclosure.

Content

No source excerpt is available for this finding.