Lattice

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:31 PM UTC
• Version: 1.2.1

Overview

The skill is transparent about creating an autonomous multi-agent pipeline, but its default recurring cron workflow can keep changing project files, spawning agents, and running generated test commands with limited approval controls.

Install only for repositories where you explicitly want recurring autonomous development work. Before enabling cron, confirm the exact repo and ORG paths, schedule, model budget, notification target, stop/delete procedure, and sandbox permissions. Treat generated TASKS.md test commands as untrusted until reviewed or constrained to an allowlist, and avoid giving the scheduled agents access to secrets, home directories, credential stores, or unrelated repositories.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:105

Finding

Persistent Autonomous Agent Execution Through a Recurring Cron Job

Content

View full analysis

` tokens filled in: - `` → project name - `` → absolute path to the ORG directory - `` → absolute path to the project directory - `` → absolute path to the code repository (ask user) - Phase prompt paths → absolute paths to the skill's bundled phase prompt templates Tell the user the cron job ID so they can manage it later. ``` ### Technical Analysis The initialization procedure directs the agent to create a recurring scheduled task with an `agentTurn` payload. This task executes in an isolated session every 30 minutes and is designed to read project state, modify persistent files, and spawn additional agents. The scheduled job has no prescribed expiration time, maximum execution count, budget ceiling, or mandatory confirmation immediately before installation. It therefore survives the initial skill invocation and can continue consuming model resources and modifying project data across sessions. The behavior is explicitly documented rather than concealed, and the job ID is disclosed afterward. Nevertheless, it constitutes system persistence because a recurring autonomous agent is installed and remains active until separately disabled or removed. ### Attack Path 1. A user or attacker induces execution of the `lattice init` workflow. 2. Project paths, agents, and model settings are supplied. 3. The ski ...[truncated 1269 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: templates/ORG/PROJECTS/pipeline-framework/templates/PHASE_PROMPTS/03_plan_tasks.md:24

Finding

Execution of AI-Generated Test Commands Without Validation or Approval

Content

View full analysis

/pipeline/IMPL_STATUS.md`, marking status after your Task ID: ``` The testing phase independently repeats execution of commands from the same persistent artifact: ```markdown ## Testing Tiers ### Level 1: Unit Test - Execute test plan defined in TASKS.md for each task - Record pass/fail for each task ### Level 2: Integration Test - Test interfaces and data flow across tasks - Verify correct interaction between modules ### Level 3: Acceptance Test - Verify against SPECIFICATION.md acceptance cri ...[truncated 3239 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence

Findings (23)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

3. **Departments** — For each department the user listed:
   - Copy `DEPARTMENTS/example-dept/` → `DEPARTMENTS/<dept-name>/`
   - In each copied department, replace `<Department Name>` placeholders in CHARTER.md, RUNBOOK.md, HANDOFF.md with the actual department name
   - Reset STATE.json to `{"lastRun": null, "cursor": null, "notes": "Initial state"}`
4. **Remove** `DEPARTMENTS/example-dept/` after creating real departments (unless user wants to keep it as reference)

### 3. Create the First Project (if requested)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The template explicitly instructs the orchestrator to collect and forward 'full context' to a triage agent, including error data, attempted solutions, and the project's CONSTITUTION and SPECIFICATION. In a multi-agent system, this can expose sensitive internal project context or secrets to another model/session without any minimization, classification, or need-to-know filtering, increasing the risk of over-sharing and downstream leakage.

Content

Scanner excerpt · templates/ORG/PROJECTS/pipeline-framework/templates/ORCHESTRATOR_PROMPT.template.md (reported line 85)May include surrounding context.

md

- Read config.autoTriage, if enabled == true:
   - Check whether this run's RELAX/DEFER count has reached the limit (maxRelaxPerRun / maxDeferPerRun)
   - IF limit not reached AND phase.stuckInfo.triageRequested != true:
     - Collect full context: error info + attempted solutions + consult synthesized solution + CONSTITUTION + SPECIFICATION
     - Read auto_triage.md template (templates/PHASE_PROMPTS/auto_triage.md)
     - Spawn triage agent: sessions_spawn(model=config.autoTriage.triageModel, task=Filled triage prompt)
     - Mark phase.stuckInfo.triageRequested = true

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs creation of an autonomous cron-driven orchestrator that will continue running on a schedule, but it does not require an explicit warning or confirmation that the user is enabling ongoing automated execution. In an agent framework, this can lead to unexpected recurring actions, cost accrual, repeated modifications, or background processing the user did not fully appreciate.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · templates/ORG/MEMORY_POLICY.md (reported line 51)May include surrounding context.

md

1. Read `ORG/TASKBOARD.md`
2. Read your department's `HANDOFF.md`
3. Check `ASSET_REGISTRY.md` (reuse first, build second)
4. If reuse/integration needed: add entry to `REUSE_REQUESTS.md` and @owner

### Closeout Sequence (after work)
1. Update your department's `HANDOFF.md` (Done / Next / Blockers + links)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The design authorizes automatic copying, archival, state resets, and log appends without an explicit user-facing warning or consent checkpoint. In an agent skill, silent file mutation can surprise operators, overwrite workflow state, or cause unintended persistence changes across runs, especially when triggered by cron.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The design permits the orchestrator to make autonomous decisions that change project state, including archiving runs, resetting phases, and advancing execution without a human in the loop. In this skill context, autonomous state-changing behavior increases the risk of unintended actions, especially when combined with cron-based triggering and later support for relaxing constraints or deferring work.

Content

Scanner excerpt · templates/ORG/PROJECTS/pipeline-framework/DESIGN.md (reported line 118)May include surrounding context.

md

**Archival Mechanism**:
- `pipeline/` always represents "the current ongoing run". The path is fixed, so Orchestrator and sub-agents don't need to care about run numbers.
- After each Review PASS, Orchestrator automatically executes archival:
  1. Copy `pipeline/*` → `pipeline_archive/run-{N}/`
  2. Increment `runNumber` in PIPELINE_STATE.json, reset all phases to pending.
  3. Append `{"event": "run_archived", "run": N}` to PIPELINE_LOG.jsonl.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The cron template directs the orchestrator to update state files, append logs, archive artifacts, and update handoff/status files automatically, but the document does not clearly warn the user that scheduled execution will perform these writes. Scheduled autonomous file writes can have persistent operational impact and are more dangerous because they recur without immediate human review.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The design document consistently defines Phase 7 Gap Analysis as part of the pipeline and states archival happens after gap_analysis is done, not immediately after Review PASS. However, the embedded cron job message tells the orchestrator to archive and reset the run at Review PASS, which would skip the documented Gap Analysis stage and conflicts with the pseudo-code and phase definitions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · templates/ORG/PIPELINE_GUIDE.md (reported line 69)May include surrounding context.

md

## What You Must NOT Do
1. **Do not modify PIPELINE_STATE.json** — that's the Orchestrator's job
2. **Do not modify previous phase artifacts** — if you find issues, note them in your own artifact
3. **Do not modify system config/gateway/channels**
4. **Do not do work belonging to other phases**
5. **Do not say "done" in chat without writing a file**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · templates/ORG/PROJECTS/pipeline-framework/DESIGN.md (reported line 443)May include surrounding context.

md

## What You Must NOT Do
1. **Do not modify PIPELINE_STATE.json** — that's the Orchestrator's job
2. **Do not modify previous phase artifacts** — if you find issues, note them in your own artifact
3. **Do not modify system config/gateway/channels**
4. **Do not do work belonging to other phases**
5. **Do not say "done" in chat without writing a file**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · templates/ORG/PROJECTS/pipeline-framework/templates/ORCHESTRATOR_PROMPT.template.md (reported line 178)May include surrounding context.

md

## What You Must NOT Do
1. **Do not modify PIPELINE_STATE.json** — that's the Orchestrator's job
2. **Do not modify previous phase artifacts** — if you find issues, note them in your own artifact
3. **Do not modify system config/gateway/channels**
4. **Do not do work belonging to other phases**
5. **Do not say "done" in chat without writing a file**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · templates/ORG/PROJECTS/pipeline-framework/templates/PHASE_PROMPTS/00_constitute.md (reported line 38)May include surrounding context.

md

## What You Must NOT Do
1. **Do not modify PIPELINE_STATE.json** — that's the Orchestrator's job
2. **Do not modify previous phase artifacts** — if you find issues, note them in your own artifact
3. **Do not modify system config/gateway/channels**
4. **Do not do work belonging to other phases**
5. **Do not say "done" in chat without writing a file**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · templates/ORG/PROJECTS/pipeline-framework/templates/PHASE_PROMPTS/01_research.md (reported line 30)May include surrounding context.

md

## What You Must NOT Do
1. **Do not modify PIPELINE_STATE.json** — that's the Orchestrator's job
2. **Do not modify previous phase artifacts** — if you find issues, note them in your own artifact
3. **Do not modify system config/gateway/channels**
4. **Do not do work belonging to other phases**
5. **Do not say "done" in chat without writing a file**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · templates/ORG/PROJECTS/pipeline-framework/templates/PHASE_PROMPTS/02_specify.md (reported line 30)May include surrounding context.

md

## What You Must NOT Do
1. **Do not modify PIPELINE_STATE.json** — that's the Orchestrator's job
2. **Do not modify previous phase artifacts** — if you find issues, note them in your own artifact
3. **Do not modify system config/gateway/channels**
4. **Do not do work belonging to other phases**
5. **Do not say "done" in chat without writing a file**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · templates/ORG/PROJECTS/pipeline-framework/templates/PHASE_PROMPTS/03_plan_tasks.md (reported line 41)May include surrounding context.

md

## What You Must NOT Do
1. **Do not modify PIPELINE_STATE.json** — that's the Orchestrator's job
2. **Do not modify previous phase artifacts** — if you find issues, note them in your own artifact
3. **Do not modify system config/gateway/channels**
4. **Do not do work belonging to other phases**
5. **Do not say "done" in chat without writing a file**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · templates/ORG/PROJECTS/pipeline-framework/templates/PHASE_PROMPTS/04_implement.md (reported line 57)May include surrounding context.

md

## What You Must NOT Do
1. **Do not modify PIPELINE_STATE.json** — that's the Orchestrator's job
2. **Do not modify previous phase artifacts** — if you find issues, note them in your own artifact
3. **Do not modify system config/gateway/channels**
4. **Do not do work belonging to other phases**
5. **Do not say "done" in chat without writing a file**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · templates/ORG/PROJECTS/pipeline-framework/templates/PHASE_PROMPTS/05_test.md (reported line 67)May include surrounding context.

md

## What You Must NOT Do
1. **Do not modify PIPELINE_STATE.json** — that's the Orchestrator's job
2. **Do not modify previous phase artifacts** — if you find issues, note them in your own artifact
3. **Do not modify system config/gateway/channels**
4. **Do not do work belonging to other phases**
5. **Do not say "done" in chat without writing a file**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · templates/ORG/PROJECTS/pipeline-framework/templates/PHASE_PROMPTS/06_review.md (reported line 92)May include surrounding context.

md

## What You Must NOT Do
1. **Do not modify PIPELINE_STATE.json** — that's the Orchestrator's job
2. **Do not modify previous phase artifacts** — if you find issues, note them in your own artifact
3. **Do not modify system config/gateway/channels**
4. **Do not do work belonging to other phases**
5. **Do not say "done" in chat without writing a file**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · templates/ORG/PROJECTS/pipeline-framework/templates/PHASE_PROMPTS/07_gap_analysis.md (reported line 96)May include surrounding context.

md

## What You Must NOT Do
1. **Do not modify PIPELINE_STATE.json** — that's the Orchestrator's job
2. **Do not modify previous phase artifacts** — if you find issues, note them in your own artifact
3. **Do not modify system config/gateway/channels**
4. **Do not do work belonging to other phases**
5. **Do not say "done" in chat without writing a file**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · templates/ORG/PROJECTS/pipeline-framework/templates/PIPELINE_GUIDE_FOR_SUBAGENTS.md (reported line 19)May include surrounding context.

md

## What You Must NOT Do
1. **Do not modify PIPELINE_STATE.json** — that's the Orchestrator's job
2. **Do not modify previous phase artifacts** — if you find issues, note them in your own artifact
3. **Do not modify system config/gateway/channels**
4. **Do not do work belonging to other phases**
5. **Do not say "done" in chat without writing a file**

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The instructions tell the agent to remove example template directories after scaffolding, but do not require a deletion warning or confirmation from the user. Even if the intended targets are template folders, destructive file operations without explicit notice increase the risk of accidental data loss, especially if paths are mis-resolved or customized.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The note says the orchestrator 'only does judgment and scheduling, not heavy lifting,' justifying use of a lightweight model. But elsewhere in the document the orchestrator is responsible for validating artifacts, deciding retries, rollbacks, model escalation, peer consult, and auto-triage coordination, which is substantially more than simple scheduling and makes the note misleading.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file contains natural-language instructions that mandate specific section headings and verdict labels in English, but it does not provide any user opt-in or locale choice. Under the stated policy, forcing a specific language without user choice can be a language/locale policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.