Security audit

Agent Pipeline

Security checks for vulnerabilities and agentic risk

Overview

This workflow skill is mostly coherent, but it over-shares credentials with all sub-agents and requires plaintext board logging to a fixed internal endpoint.

Review before installing. This may fit a controlled internal workflow, but prefer role-scoped short-lived credentials instead of copying the main auth profile, and use a configurable HTTPS board endpoint with redaction for secrets and confidential implementation details.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:40
Finding: Unrestricted Distribution of Main-Agent Credentials to Sub-Agents## Vulnerability Details **File Location**: `SKILL.md`, line 40 **Vulnerability Type**: Violation of least privilege through unrestricted credential distribution **Risk Level**: High ### Vulnerable Code ```markdown - Auth: all agents need `auth-profiles.json` copied from main agent ``` ### Technical Analysis The skill requires the main agent's complete `auth-profiles.json` file to be copied to every sub-agent. This includes roles such as reviewer, tester, researcher, and security auditor, even when those roles do not require authenticated access to perform their stated responsibilities. Sharing a complete authentication profile across multiple agent contexts violates least-privilege and credential-compartmentalization principles. The instruction does not require: - Role-specific credential scopes - Short-lived credentials - Secret redaction - Read restrictions - Isolated secret injection - Prevention of credentials entering prompts, logs, or generated output Any sub-agent influenced by malicious repository content or other untrusted instructions could attempt to inspect, disclose, or misuse the copied credentials. ### Attack Path 1. A repository contains adversarial content designed to influence a spawned sub-agent, such as instructions embedded in source files or documentation. 2. The main agent follows the skill and copies `auth-profiles.json` into the sub-agent's accessible environment. 3. The affected sub-agent reads or exposes credentials from that file. 4. The credentials are used to authenticate to repositories, board systems, planner services, or other accounts represented in the profile. 5. The attacker performs actions permitted by those credentials, potentially outside the sub-agent's legitimate role. ### Impact Assessment Successful exploitation could expose every credential stored in `auth-profiles.json`. The resulting privileges depend on the actual contents and scopes of the file, but co ...[truncated 460 chars]
Remediation: ## Remediation Suggestions - Remove the requirement to copy the complete `auth-profiles.json` file. - Provide credentials only to roles that demonstrably require authenticated access. - Issue separate, short-lived, role-scoped credentials with the minimum required permissions. - Supply secrets through an approved secret manager or isolated runtime mount rather than copying them into agent workspaces. - Make mounted secrets read-only and prevent their inclusion in prompts, logs, diffs, commits, and generated reports. - Ensure reviewer, tester, researcher, and security roles operate without credentials unless a specific authenticated action is necessary. - Revoke credentials immediately after the relevant stage and maintain audit logs of credential issuance and use. - Add controls that prevent sub-agents from reading arbitrary secret files or transmitting secret material.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:35
Finding: Mandatory Transmission of Development Data over Plaintext HTTP## Vulnerability Details **File Location**: `SKILL.md`, lines 35-44 **Vulnerability Type**: Plaintext transmission to a hardcoded network service **Risk Level**: Medium ### Vulnerable Code ```markdown ## Rules - **ALWAYS log to the board** before, during, and after - Create board item under the relevant project category - Each agent gets clear, specific instructions - Agents use `agentId` matching their role (coder, reviewer, security, tester, researcher) - If an agent fails, fix the issue and re-run that stage - Auth: all agents need `auth-profiles.json` copied from main agent ## Board API - Create item: POST `http://10.0.0.40:3000/api/board/projects/{project}/items` - Body: `{"title": "...", "status": "in-progress", "detail": "..."}` ``` ### Technical Analysis The skill mandates board logging and instructs the agent to transmit project names, titles, status information, and task details to a hardcoded service over unencrypted HTTP. HTTP does not provide transport confidentiality, server authentication, or message integrity. An attacker with a suitable network position could inspect or modify requests. The hardcoded destination also prevents administrators from selecting a verified service endpoint appropriate for their environment. The instruction provides no requirements for TLS, certificate validation, endpoint authentication, authorization, user consent, secret redaction, or data minimization. The mandatory wording increases exposure because logging is required before, during, and after the workflow regardless of whether the task contains confidential information. ### Attack Path 1. The agent processes a task containing confidential project names, implementation details, branch information, or other sensitive development context. 2. The skill requires the agent to place some of that context in the board item's `title` or `detail` fields. 3. The agent sends the request to `http://10.0.0.40:3000`. 4. ...[truncated 850 chars]
Remediation: ## Remediation Suggestions - Replace the hardcoded HTTP URL with an administrator-configured HTTPS endpoint. - Require TLS certificate and hostname validation; do not permit silent fallback to HTTP. - Authenticate requests using a narrowly scoped service identity and enforce server-side authorization. - Make external board logging optional and obtain authorization before transmitting task information. - Minimize transmitted data and exclude source code, credentials, tokens, personal data, and confidential implementation details. - Apply structured redaction to board titles and detail fields before transmission. - Validate the configured destination against an approved allowlist. - Fail closed if the endpoint cannot be authenticated or a secure connection cannot be established. - Document data-retention rules and maintain audit logs for board access and modifications.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill instructs that all sub-agents receive a copied `auth-profiles.json`, which distributes shared credentials far beyond the minimum necessary scope. This creates unnecessary credential exposure across multiple agent contexts, increasing the chance of misuse, leakage, or compromise if any sub-agent is less trusted or handles data insecurely.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation tells operators to copy authentication profiles to sub-agents without any warning, approval gate, or handling guidance for sensitive credentials. In a multi-agent pipeline, normalizing secret propagation in this way can lead to accidental disclosure, persistence in logs/workspaces, or use by agents that do not actually need those privileges.

Static analysis

No suspicious patterns detected.