Security audit
Security checks for vulnerabilities and agentic risk
This skill is a real planning tool, but its installer and examples can run unchecked code and its workflow can let AI tools change and merge repository files beyond a plan.
Review before installing. Prefer a local, pinned checkout instead of the curl-to-bash installer; avoid the documented sandbox-bypass examples; run only in a disposable or trusted repository; use --no-merge; inspect the full git diff before accepting output; and treat specs/findings as untrusted because they can influence provider actions and contract checks.
SKILL.md:22Mutable Remote Installer Is Piped Directly into Bash
scripts/install.sh:11Installer Clones and Imports Unpinned Remote Dependencies
scripts/adversarial_plan.py:583Specification-Controlled Acceptance Directives Reach a Command-Execution Gate
scripts/phases/phase_plan.py:128LLM Providers Can Modify Arbitrary Repository Files That Are Subsequently Committed
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
python3 scripts/adversarial_plan.py
--spec spec.md
--findings findings.json
--dev-cmd "pi --provider zai --model glm-5.2"
--review-cmd "pi --provider deepseek --model deepseek-v4-pro"
The top-level purpose understates extensive orchestration features such as branch lifecycle management, CI/report behavior, provider selection/fallback, delegated execution, and rejection handling. In an agent setting, these hidden operational behaviors are security-relevant because they can alter repositories, influence pipelines, and expand the action surface far beyond 'generate a plan'.
The top-level purpose understates extensive orchestration features such as branch lifecycle management, CI/report behavior, provider selection/fallback, delegated execution, and rejection handling. In an agent setting, these hidden operational behaviors are security-relevant because they can alter repositories, influence pipelines, and expand the action surface far beyond 'generate a plan'.
The top-level purpose understates extensive orchestration features such as branch lifecycle management, CI/report behavior, provider selection/fallback, delegated execution, and rejection handling. In an agent setting, these hidden operational behaviors are security-relevant because they can alter repositories, influence pipelines, and expand the action surface far beyond 'generate a plan'.
The top-level purpose understates extensive orchestration features such as branch lifecycle management, CI/report behavior, provider selection/fallback, delegated execution, and rejection handling. In an agent setting, these hidden operational behaviors are security-relevant because they can alter repositories, influence pipelines, and expand the action surface far beyond 'generate a plan'.
The top-level purpose understates extensive orchestration features such as branch lifecycle management, CI/report behavior, provider selection/fallback, delegated execution, and rejection handling. In an agent setting, these hidden operational behaviors are security-relevant because they can alter repositories, influence pipelines, and expand the action surface far beyond 'generate a plan'.
The top-level purpose understates extensive orchestration features such as branch lifecycle management, CI/report behavior, provider selection/fallback, delegated execution, and rejection handling. In an agent setting, these hidden operational behaviors are security-relevant because they can alter repositories, influence pipelines, and expand the action surface far beyond 'generate a plan'.
The pipe into bash creates a dangerous chaining pattern where untrusted network content flows directly into a shell interpreter. This removes opportunities for inspection and amplifies the impact of any upstream compromise or content tampering.
Requires the `adversarial-common` sibling repo (shared engine). One-line install:
curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-plan/main/scripts/install.sh | bash
or, from an existing checkout:
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
## CLI
<!-- CLI-FLAG-TABLE:START -->
| Flag | Value/default | Purpose |
|------|---------------|---------|
Referenced artifact was not completely inspected
spec. See [Running plan steps without plan mode](references/run-plan-steps-without-plan-mode.md)
The example command explicitly tells the downstream tool to bypass approvals and sandbox protections, yet it is shown as a normal usage example without strong warnings. This trains users to disable core safety controls and materially increases the chance of destructive file, git, or shell actions in the target repository or environment.
The command includes --dangerously-bypass-approvals-and-sandbox, which directly disables important safety boundaries for model-driven execution. In the context of a skill that already performs git, file, and shell orchestration, this can enable unchecked destructive or malicious actions with minimal friction.
The code creates dedicated branches and may squash-merge results back into the parent branch, but the skill description only presents it as producing a plan. Hidden repository mutation is dangerous because users may invoke what they believe is a read-mostly planning step and instead get persistent VCS state changes and merges.
Repository mutation and merge behavior go beyond the stated purpose of planning and can persist AI-generated artifacts into the codebase. If triggered in automation or by a trusting operator, this can alter branch history, contaminate reviews, or merge low-quality or policy-violating content under the guise of a planner.
Piping downloaded content directly into bash is a classic command-chaining anti-pattern that executes attacker-controlled content without inspection. In this skill context, the risk is heightened because the script proceeds to clone additional repositories and set Python import paths, extending the blast radius of any upstream compromise into persistent local code installation.
#!/usr/bin/env bash
# Install adversarial-plan with its single dependency: adversarial-common (sibling layout).
# Usage:
# Bootstrap (from anywhere): curl -fsSL https://raw.githubusercontent.com/chpomob/adversarial-plan/main/scripts/install.sh | bash
# From a checkout: bash scripts/install.sh [TARGET_DIR]
# Target layout (siblings required):
# <TARGET>/adversarial-plan (this skill)
The README states that FINALIZE will squash-merge approval unless --no-merge is set, which implies the tool may modify repository history/state by default. In an agent skill context, especially one designed to automate planning workflows, undocumented or weakly warned write actions increase the risk of unintended repository changes when a user assumes the tool is read-only or advisory.
The skill documents capabilities that include shell execution, filesystem access, and environment access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That makes the effective privilege boundary unclear and increases the risk that an agent invokes the skill with broader powers than intended, especially given the documented git, install, and subprocess behaviors.
The triggering context is broad and does not clearly constrain when the skill should or should not be invoked, despite it having write, shell, git, and optional network behaviors. Overbroad invocation guidance makes accidental misuse more likely, including activation in repositories or situations where its orchestration powers are inappropriate.
The installation instructions execute a remote script directly via curl piped to bash, creating a classic remote code execution and supply-chain risk. This is especially unjustified for a planning skill because the documented purpose does not require blind execution of unreviewed network content during normal use.
The documentation presents a remote script piped to bash without a nearby warning, normalization of risk, or integrity verification guidance. Users may execute it casually, leading to arbitrary code execution if the script, hosting account, or transport path is compromised.
Deep-research mode adds externally sourced information gathering and provider command execution beyond the stated planner role. This increases the attack surface through network access, prompt injection from external content, and possibly untrusted subprocess behavior if users are not clearly warned and scoped.
The manifest frames the skill as producing a plan, while the workflow documentation adds delegated execution paths and automatic merge/finalization behavior. This discrepancy can cause operators or automated controls to underestimate how much repository state the skill can change.
The document explicitly recommends running Codex with --dangerously-bypass-approvals-and-sandbox, which disables important execution and approval safeguards. In a skill whose purpose is to automate an adversarial planning pipeline against a target repository, this materially increases the chance of destructive filesystem changes, unsafe command execution, or unintended actions on the host without adequate user confirmation.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
The reference explicitly tells operators to run codex exec --dangerously-bypass-approvals-and-sandbox, which disables normal approval and sandbox protections while executing generated code against a repository. In the context of an adversarial planning/code-loop skill, this materially increases the chance that unsafe or malicious generated actions can modify files, exfiltrate data reachable from the workspace, or perform unintended operations without a human checkpoint.
No suspicious patterns detected.