Security audit

Async Programming

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent async coding helper, but it automatically spawns long-running coding sub-agents for broad programming requests without a clear consent or scoping boundary.

Install only if you want programming requests to be delegated automatically to background coding agents. Use it on repositories where asynchronous file edits, configuration changes, and dependency additions are acceptable, and consider adding an explicit confirmation requirement before sub-agents run on sensitive or ambiguous tasks.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The natural-language instructions and response templates are entirely specified in Chinese, with no indication that the skill should adapt to the user's preferred language. This can violate language or locale policy when a skill implicitly enforces one language without opt-in or documented justification.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger conditions are extremely broad and activate on nearly any programming-related request, causing the skill to spawn a code-writing sub-agent by default. In context, this can lead to unintended autonomous code changes, dependency installation, or project actions without an explicit opt-in or confirmation boundary from the user.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill tells the assistant to immediately dispatch a programming sub-agent for common coding requests, but it does not warn users that this may modify project files or install dependencies. In this context, the omission is dangerous because the examples explicitly include file edits and dependency installation, so users may not realize they are authorizing potentially impactful changes.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill is configured to activate for a very broad set of common programming requests, which can cause unintended invocation and automatic spawning of sub-agents for routine conversations. In this context, the risk is amplified because the skill explicitly instructs immediate execution via sub-agent before further deliberation, increasing the chance of unnecessary code actions, resource consumption, or execution on ambiguous user intent.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The manifest content, user-facing descriptions, and response templates are entirely written in Chinese, indicating the skill is designed to respond in a fixed language. There is no visible opt-in, language selection mechanism, or documented region-specific justification for restricting output language.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The manifest says the skill should activate whenever a user requests a programming task, which is overly broad and can cause the skill to intercept many unrelated coding requests automatically. In this skill's context, that broad trigger is more dangerous because it immediately spawns subagents and replies before results are reviewed, increasing the chance of unnecessary background execution, resource abuse, or unintended delegation of sensitive tasks.

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: The title, description, author field, and examples are all written in Chinese, with no indication that the skill supports user language preference or is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy expectations when no opt-in or justification is provided.

Static analysis

No suspicious patterns detected.