Agent Pipeline

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:18 AM UTC
• Version: 1.0.0

Overview

This workflow skill is mostly coherent, but it over-shares credentials with all sub-agents and requires plaintext board logging to a fixed internal endpoint.

Review before installing. This may fit a controlled internal workflow, but prefer role-scoped short-lived credentials instead of copying the main auth profile, and use a configurable HTTPS board endpoint with redaction for secrets and confidential implementation details.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:40

Finding

Unrestricted Distribution of Main-Agent Credentials to Sub-Agents

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 40
Vulnerability Type: Violation of least privilege through unrestricted credential distribution
Risk Level: High

Vulnerable Code

markdown

- Auth: all agents need `auth-profiles.json` copied from main agent

Technical Analysis

The skill requires the main agent's complete auth-profiles.json file to be copied to every sub-agent. This includes roles such as reviewer, tester, researcher, and security auditor, even when those roles do not require authenticated access to perform their stated responsibilities.

Sharing a complete authentication profile across multiple agent contexts violates least-privilege and credential-compartmentalization principles. The instruction does not require:

• Role-specific credential scopes
• Short-lived credentials
• Secret redaction
• Read restrictions
• Isolated secret injection
• Prevention of credentials entering prompts, logs, or generated output

Any sub-agent influenced by malicious repository content or other untrusted instructions could attempt to inspect, disclose, or misuse the copied credentials.

Attack Path

1. A repository contains adversarial content designed to influence a spawned sub-agent, such as instructions embedded in source files or documentation.
2. The main agent follows the skill and copies auth-profiles.json into the sub-agent's accessible environment.
3. The affected sub-agent reads or exposes credentials from that file.
4. The credentials are used to authenticate to repositories, board systems, planner services, or other accounts represented in the profile.
5. The attacker performs actions permitted by those credentials, potentially outside the sub-agent's legitimate role.

Impact Assessment

Successful exploitation could expose every credential stored in auth-profiles.json. The resulting privileges depend on the actual contents and scopes of the file, but co ...[truncated 460 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the requirement to copy the complete auth-profiles.json file.
• Provide credentials only to roles that demonstrably require authenticated access.
• Issue separate, short-lived, role-scoped credentials with the minimum required permissions.
• Supply secrets through an approved secret manager or isolated runtime mount rather than copying them into agent workspaces.
• Make mounted secrets read-only and prevent their inclusion in prompts, logs, diffs, commits, and generated reports.
• Ensure reviewer, tester, researcher, and security roles operate without credentials unless a specific authenticated action is necessary.
• Revoke credentials immediately after the relevant stage and maintain audit logs of credential issuance and use.
• Add controls that prevent sub-agents from reading arbitrary secret files or transmitting secret material.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:35

Finding

Mandatory Transmission of Development Data over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35-44
Vulnerability Type: Plaintext transmission to a hardcoded network service
Risk Level: Medium

Vulnerable Code

markdown

## Rules
- **ALWAYS log to the board** before, during, and after
- Create board item under the relevant project category
- Each agent gets clear, specific instructions
- Agents use `agentId` matching their role (coder, reviewer, security, tester, researcher)
- If an agent fails, fix the issue and re-run that stage
- Auth: all agents need `auth-profiles.json` copied from main agent

## Board API
- Create item: POST `http://10.0.0.40:3000/api/board/projects/{project}/items`
- Body: `{"title": "...", "status": "in-progress", "detail": "..."}`

Technical Analysis

The skill mandates board logging and instructs the agent to transmit project names, titles, status information, and task details to a hardcoded service over unencrypted HTTP.

HTTP does not provide transport confidentiality, server authentication, or message integrity. An attacker with a suitable network position could inspect or modify requests. The hardcoded destination also prevents administrators from selecting a verified service endpoint appropriate for their environment.

The instruction provides no requirements for TLS, certificate validation, endpoint authentication, authorization, user consent, secret redaction, or data minimization. The mandatory wording increases exposure because logging is required before, during, and after the workflow regardless of whether the task contains confidential information.

Attack Path

1. The agent processes a task containing confidential project names, implementation details, branch information, or other sensitive development context.
2. The skill requires the agent to place some of that context in the board item's title or detail fields.
3. The agent sends the request to http://10.0.0.40:3000.

...[truncated 850 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the hardcoded HTTP URL with an administrator-configured HTTPS endpoint.
• Require TLS certificate and hostname validation; do not permit silent fallback to HTTP.
• Authenticate requests using a narrowly scoped service identity and enforce server-side authorization.
• Make external board logging optional and obtain authorization before transmitting task information.
• Minimize transmitted data and exclude source code, credentials, tokens, personal data, and confidential implementation details.
• Apply structured redaction to board titles and detail fields before transmission.
• Validate the configured destination against an approved allowlist.
• Fail closed if the endpoint cannot be authenticated or a secure connection cannot be established.
• Document data-retention rules and maintain audit logs for board access and modifications.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs that all sub-agents receive a copied auth-profiles.json, which distributes shared credentials far beyond the minimum necessary scope. This creates unnecessary credential exposure across multiple agent contexts, increasing the chance of misuse, leakage, or compromise if any sub-agent is less trusted or handles data insecurely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation tells operators to copy authentication profiles to sub-agents without any warning, approval gate, or handling guidance for sensitive credentials. In a multi-agent pipeline, normalizing secret propagation in this way can lead to accidental disclosure, persistence in logs/workspaces, or use by agents that do not actually need those privileges.

Content

No source excerpt is available for this finding.