Dark Launch Controller

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:19 AM UTC
• Version: 1.0.1

Overview

The skill fits dark-launch operations, but one shell/Python snippet can turn a crafted feature name into code execution in the user's environment.

Review and fix the heredoc before installing or using this skill: pass the feature name through an environment variable or argv, quote the heredoc delimiter, and validate feature names against a narrow safe pattern. Use read-only, namespace-scoped Kubernetes credentials for planning and monitoring, and require explicit human approval before applying rollout, rollback, or restart commands.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:60

Finding

Python Code Injection Through Untrusted Feature Name Interpolation

Content

View full analysis

Remediation

View remediation

&2 exit 1 ;; esac ``` 2. Avoid constructing executable code through string interpolation in shell scripts. 3. Run planning and monitoring workflows with read-only, namespace-scoped Kubernetes credentials. 4. Grant configuration mutation and rollout-restart permissions only to promotion or rollback workflows that require them. 5. Add tests using quotation marks, newlines, Python operators, and shell metacharacters to ensure input remains data rather than executable code. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

md

PROM_URL="${PROMETHEUS_URL:-http://prometheus.monitoring.svc:9090}"

echo "=== Feature code path latency ==="
curl -s "$PROM_URL/api/v1/query" \
  --data-urlencode "query=histogram_quantile(0.99, rate(http_request_duration_seconds_bucket{feature=\"${FEATURE_KEY}\"}[5m]))" \
  2>/dev/null | python3 -c "
import json, sys

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

md

echo ""
echo "=== Feature error rate ==="
curl -s "$PROM_URL/api/v1/query" \
  --data-urlencode "query=rate(http_requests_total{feature=\"${FEATURE_KEY}\",status=~\"5..\"}[5m]) / rate(http_requests_total{feature=\"${FEATURE_KEY}\"}[5m])" \
  2>/dev/null | python3 -c "
import json, sys

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation list includes generic phrases like "hidden feature" and especially "launch plan," which are not narrowly scoped to this skill's dark-launch context. In a markdown skill description, such broad triggers can overlap with ordinary product or project discussions and make activation boundaries unclear.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.