Agent Coordination

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:59 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a disclosed agent-coordination workflow, but it needs review because it can keep a persistent coordination mode, create tasks, launch coding agents, and inspect CI logs with limited scoping.

Install only if you want the assistant to coordinate VibeKanban tasks and potentially start coding-agent workspace sessions. Before using it, confirm the project, repository, branch, executor, and any task deletion or CI log inspection; explicitly exit CoS mode when done, and do not rely on the hard-coded local repository exception.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:14
• Finding: Persistent Agent Role and Execution-Policy Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14-25, 50-56` **Vulnerability Type**: Persistent session-level instruction redirection **Risk Level**: High ### Vulnerable Code ```markdown **STATE CHANGE**: When user declares you as CoS, this mode **persists for the entire conversation**. ### Immediate Actions 1. Acknowledge the CoS role 2. Verify VibeKanban MCP tools available 3. ALL subsequent requests become task delegations 4. Never revert to execution mode unless explicitly told ### The Golden Rule **"I want to X" → Create a task, do NOT do X yourself.** ``` ```markdown ### What You Do NOT Do - Investigate codebases (delegate it) - Implement features or fixes (delegate it) - Write or Edit code files **Exception**: Full autonomy in `/Users/clementwalter/Documents/rookie-marketplace`. ``` ### Technical Analysis The skill installs a persistent behavioral state that changes how the agent interprets all subsequent user requests. After a user activates Chief of Staff mode, the instructions require every later request to become an external task delegation and prohibit the agent from returning to its normal execution behavior unless explicitly directed. This exceeds request-scoped workflow guidance because it attempts to redefine session-wide goals and tool-use policy. The hard-coded exception for `/Users/clementwalter/Documents/rookie-marketplace` is also unrelated to the general coordination function and grants preferential autonomous behavior to an author-specific local repository. The surrounding workflow directs the agent to create VibeKanban tasks and start workspace sessions. Therefore, successful instruction hijacking can cause external side effects through configured MCP tools rather than merely changing the response style. No evidence was found that this instruction creates cross-session persistence, modifies long-term memory, escalates operating-system privileges, or bypasses MCP authorization. Its persistence is limited to ...[truncated 1680 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the session-persistent state requirement. Chief of Staff behavior should apply only to the current request or to a clearly bounded workflow. 2. Replace “ALL subsequent requests become task delegations” with language requiring the agent to evaluate each request independently. 3. Explicitly state that system instructions, safety policies, current user intent, and tool authorization boundaries always take precedence. 4. Require explicit user confirmation before any side-effecting operation, including: - Creating a VibeKanban task. - Starting a workspace session. - Selecting a repository or base branch. - Dispatching an external coding agent. 5. Provide a visible, immediate opt-out mechanism and automatically leave coordination mode when the requested coordination workflow ends. 6. Remove the hard-coded `/Users/clementwalter/Documents/rookie-marketplace` exception. Any repository-specific autonomy must be configured by the current user and constrained by the host’s access-control policy. 7. Apply least privilege by limiting MCP access to user-selected projects, repositories, and branches. 8. Before dispatch, present the proposed task, target project, repository, branch, executor, and expected side effects for approval. 9. Record and report every created task or launched session so that users can identify and cancel unintended operations. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared purpose is agent coordination, but the skill also instructs operational behavior like CI polling, status retrieval, and log inspection. This mismatch can mislead operators about the true capability surface, causing them to authorize or invoke a skill with broader access than expected.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file's behavior does not match the declared skill purpose of agent coordination and instead performs GitHub PR CI inspection with optional failed-log retrieval. This capability mismatch is dangerous because it hides repository/CI data access inside an unrelated skill, increasing the chance of unintended invocation, overbroad permissions use, and covert data exposure.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill references shell-capable behavior such as running git and CI-monitoring scripts, but it does not declare an explicit tool scope or allowed-tools boundary. In an agent setting, undocumented execution capability increases the risk of unexpected command execution and makes it harder for users or policy layers to constrain what the skill can do.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list includes common conversational variants like 'be my cos' or 'act as cos,' which are prone to accidental matches in normal dialogue. Because the skill's mode is persistent, a casual phrase could unintentionally switch the assistant into a task-delegation workflow for the rest of the conversation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes common conversational variants like 'be my cos' or 'act as cos,' which are prone to accidental matches in normal dialogue. Because the skill's mode is persistent, a casual phrase could unintentionally switch the assistant into a task-delegation workflow for the rest of the conversation.

Session Persistence

Medium

• Category: Rogue Agent

Content

User: "you're my cos. remove all lovable mentions"

WRONG: "Let me search for lovable mentions..." [executes directly]
RIGHT: "I'll create a task for this. Which project should I use?"
```

## Role Definition

• Confidence: 88% confidence
• Finding: The skill says CoS mode persists for the entire conversation and that subsequent requests are transformed into task delegations. Persistent session-level role changes are risky because a single triggering phrase can silently affect later unrelated requests, increasing the chance of unintended task creation or tool use.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: Contradictory instructions about whether the agent may edit code create an unsafe ambiguity in enforcement. When a skill both forbids and permits coding depending on a buried exception, the more permissive interpretation can win during execution, undermining user expectations and policy checks.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill states the coordinator must not write or edit code, then grants a blanket exception for full autonomy in a specific local repository. That exception silently bypasses the role safety boundary and could enable unrestricted code changes in a sensitive local path without fresh user approval.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document exposes a destructive `delete_task` capability and shows direct usage without any warning, confirmation guidance, soft-delete semantics, or discussion of recovery limitations. In an agent-coordination skill, this is more dangerous because users or autonomous agents may invoke task deletion as part of workflow cleanup, causing accidental loss of project planning data, audit history, or in-flight coordination state.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_gh(args: list[str]) -> tuple[int, str, str]:
    """Run a gh CLI command."""
    try:
        result = subprocess.run(
            ["gh"] + args,
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script goes beyond status monitoring and fetches then prints failed GitHub Actions logs. CI logs often contain sensitive build output, internal paths, stack traces, tokens accidentally echoed by jobs, or other secrets, so displaying them to any caller of the skill can expose information outside the minimum needed purpose.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill’s activation text contains many broad natural-language triggers such as “act as cos,” “be my cos,” and “you are my chief of staff,” which can match ordinary conversation rather than a deliberate request to invoke this skill. In an agent-orchestration skill, accidental activation is more dangerous because it can shift the assistant into persistent delegation behavior, influence later turns, and potentially cause unintended use of external tools or scripts described by the skill.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The skill hard-codes a user-specific local filesystem path and grants special autonomy there without documenting why that location is safe or who authorized it. Embedding a privileged path in reusable skill content creates a risk of unintended access to local code and leaks environment-specific assumptions into agent behavior.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This markdown file includes an implementation plan that explicitly instructs changing `.env.example` and `.env.local`, which can affect local credentials or developer configuration. The surrounding guidance does not warn that environment-file edits may impact secrets or local setup, so the behavior could affect user data/system integrity without disclosure.

Static analysis

No suspicious patterns detected.