Security audit

Project Bootstrap

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent project bootstrap workflow, but it asks agents to create repositories, change GitHub settings, post to Discord, and grant broad subagent tools without enough approval or scoping guidance.

Install only if you are comfortable with the agent making GitHub and Discord changes after your explicit review. Before using it, change generated agents to least-privilege tool allowlists, require confirmation before repo/ruleset/webhook/CI changes, use private Discord channels, minimize posted task and commit details, pin third-party GitHub Actions to reviewed commit SHAs, and require at least one human approval on protected branches.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:54
Finding: Generated agents receive an overprivileged full tool profile
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/ci-cd-templates.md:83
Finding: CI templates reference third-party GitHub Actions through mutable version tags
Content: View full analysis
Remediation: View remediation
``` 2. Add a comment recording the corresponding release version so maintainers can understand and update the pin. 3. Review upstream release notes and source changes before updating any pinned SHA. 4. Configure explicit top-level or job-level GitHub Actions permissions, starting with: ```yaml permissions: contents: read ``` 5. Set unused permissions to `none` and avoid granting write access to notification or coverage jobs. 6. Place secret-consuming steps in isolated jobs with no unnecessary repository permissions. 7. Do not expose repository secrets to workflows triggered by untrusted fork pull requests. 8. Use dependency-update automation that proposes SHA updates through reviewed pull requests. 9. Consider replacing the Discord action with a minimal, internally reviewed notification step or trusted internal action. 10. Rotate the Discord webhook immediately if action compromise or unexpected use is suspected. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: references/ci-cd-templates.md:135
Finding: Recommended branch protection permits merges without independent approval
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description claims a broad project bootstrap skill covering new-project setup, agent-team design, GitHub repo setup, CI/CD pipeline creation, and Discord notifications. The supplied code does not perform those functions. Instead, it is a taskboard management CLI with pluggable backends: local JSON storage and GitHub Issues synchronization. Its GitHub use is limited to issue creation/updates/comments for tasks, not repository setup or pipeline provisioning. There is no code for creating repos, initializing source code structure, configuring CI/CD/TDD workflows, or sending Discord notifications. While task management is one component mentioned in the description, the overall declared purpose materially overstates and mischaracterizes the code’s actual primary behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs actions that can affect files, environment-backed credentials, networked services, and external systems, but it does not declare an explicit tool scope or permission boundary. In a project-bootstrap context, that omission is risky because the workflow includes repo creation, ruleset changes, webhook setup, and file generation, increasing the chance of overbroad execution without clear user-visible constraints.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill provides concrete instructions for creating repositories, applying branch protection, and configuring webhooks, but does not prominently warn that these actions modify external services and project state. In this context, that can lead to unintended repo creation, policy changes, or secret-bearing webhook setup by an agent acting without an explicit user approval checkpoint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The Discord notification template transmits commit messages and author names to an external Discord webhook, which can leak internal development metadata to a third party. In a project-bootstrap skill, this is more dangerous because users may copy the template directly into new repositories without realizing that commit content and contributor identity are being exfiltrated outside GitHub.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document instructs agents to send taskboard summaries and notifications to Discord, which is an external communication channel, without any guidance on data minimization, channel access control, or avoiding sensitive project details. In a multi-agent project bootstrap skill, task titles, notes, blockers, PR references, and architecture status can easily contain confidential roadmap, security, or operational information, so normalizing automatic posting increases the risk of unintended data exposure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/taskboard.py (reported line 99)May include surrounding context.
python
print(f"⚠️ {config.get('token_env', 'GITHUB_TOKEN')} not set, GitHub sync disabled") def _api(self, method: str, endpoint: str, data: dict = None) -> dict | list: url = f"https://api.github.com/repos/{self.repo}/{endpoint}" body = json.dumps(data).encode() if data else None req = Request(url, data=body, method=method) req.add_header("Authorization", f"token {self.token}")

Static analysis

No suspicious patterns detected.