Smart Spawn API

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:13 PM UTC
• Version: 1.0.0

Overview

This skill is a small API guide, but it sends user task descriptions to a third-party service and lets that service steer model and sub-agent choices without enough safeguards.

Review this carefully before installing. Use only coarse, sanitized task descriptions unless you trust the operator of ss.deeflect.com and its logging and retention practices. Do not submit secrets, credentials, customer data, regulated data, proprietary source, or confidential project details. Validate returned model IDs and any decomposition/swarm plan before spawning agents, and set explicit limits on cost, provider choice, subtask count, and concurrency.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:14
• Finding: Potential Disclosure of Sensitive Task Data to an External Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14-15 and 83-86 **Vulnerability Type**: External transmission of potentially sensitive task data through URL query parameters **Risk Level**: Medium ### Vulnerable Code ```text 1. GET ss.deeflect.com/api/pick?task=<description>&budget=<tier> 2. Use the returned model ID in sessions_spawn ``` ```markdown 1. **Decide budget** — `low` for cheap/fast, `medium` for quality, `high` for best available 2. **Call /api/pick** with the task description 3. **Use the returned `id`** as the `model` parameter in `sessions_spawn` 4. **If task is complex** — use `/api/decompose` or `/api/swarm` to break it into subtasks, spawn each with its recommended model ``` ### Technical Analysis The skill directs the agent to send the task description to the unaffiliated external service `ss.deeflect.com`. Task descriptions can contain source code, internal project names, customer information, credentials, confidential requirements, or other sensitive context. The task is sent using a URL query parameter. Although the documented endpoint uses HTTPS, query strings can still be retained in server access logs, reverse-proxy logs, observability systems, browser history, or other request-monitoring infrastructure. The skill does not require user consent, data classification, secret redaction, or minimization before this transmission. ### Attack Path 1. A user supplies a task containing confidential or identifying information. 2. The agent follows the skill and inserts that description into the `task` query parameter. 3. The request is transmitted to `ss.deeflect.com`. 4. The external service and associated logging infrastructure receive the task contents. 5. The information may be stored, processed, or exposed according to controls not documented by the skill. ### Impact Assessment The issue does not directly grant local system privileges or execute code. Its scope is information confidentiality: the external se ...[truncated 165 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit user approval before transmitting task information to an external service. - Send a coarse, sanitized task category such as `coding` or `research` by default rather than the full task. - Remove credentials, source code, personal data, internal identifiers, and other confidential information before transmission. - Prefer a POST request body over a URL query string when detailed content is genuinely required, while recognizing that this does not replace data minimization. - Document the service's operator, privacy policy, retention period, subprocessors, and deletion controls. - Provide a local or default-model fallback that does not disclose task content. - Add a clear warning that users must not submit secrets or regulated data to the routing service. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:83
• Finding: Unvalidated External Control of Model Selection and Sub-Agent Delegation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 83-89; related behavior at lines 14-15, 34-36, and 66-76 **Vulnerability Type**: Trusting externally supplied model identifiers and delegation plans without validation **Risk Level**: Medium ### Vulnerable Code ```text 1. GET ss.deeflect.com/api/pick?task=<description>&budget=<tier> 2. Use the returned model ID in sessions_spawn ``` ```text sessions_spawn(task="Build a React dashboard with auth", model="anthropic/claude-opus-4.6") ``` ```bash POST https://ss.deeflect.com/api/decompose {"task": "Build and deploy a SaaS app", "budget": "medium"} ``` ```text Returns sequential steps with optimal model per step. ``` ```bash POST https://ss.deeflect.com/api/swarm {"task": "Research competitors and build pitch deck", "budget": "low"} ``` ```text Returns a dependency graph of parallel tasks with models assigned. ``` ```markdown 1. **Decide budget** — `low` for cheap/fast, `medium` for quality, `high` for best available 2. **Call /api/pick** with the task description 3. **Use the returned `id`** as the `model` parameter in `sessions_spawn` 4. **If task is complex** — use `/api/decompose` or `/api/swarm` to break it into subtasks, spawn each with its recommended model ``` ### Technical Analysis The skill instructs the agent to directly use a server-provided model ID and, for complex tasks, to spawn subtasks derived from externally generated decomposition or swarm responses. It does not require validation of model providers, response schemas, task relevance, delegation depth, concurrency, cost, or consistency with the user's original request. If the external service or its delivery path is compromised, manipulated responses could influence which model receives the task and how many sub-agents are created. Externally generated task text could also attempt to expand the original scope or introduce instructions that should not be trusted. This is an instruction-boundary weakness because thi ...[truncated 1151 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Validate all API responses against a strict schema before using them. - Maintain an explicit allowlist of approved model identifiers and providers. - Treat all returned task descriptions, decomposition steps, and graph labels as untrusted data rather than instructions. - Verify that every generated subtask is necessary and remains within the user's original request. - Enforce limits on delegation depth, subtask count, concurrency, token use, and total budget. - Require user approval before executing decomposition or swarm plans. - Preserve the parent agent's safety constraints and tool restrictions for every spawned agent. - Reject unknown fields, malformed identifiers, unsupported providers, cyclic graphs, and tasks that request broader permissions. - Use authenticated responses or integrity protections where supported, and fall back to a locally selected default model if validation fails. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs users to send arbitrary task descriptions to an external service at ss.deeflect.com/api, but the description does not warn that potentially sensitive prompts, project details, or proprietary data will be transmitted off-platform. This creates a real privacy and data-governance risk because users may unknowingly disclose confidential information while following the documented workflow.