Security audit

Smart Spawn API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small API guide, but it sends user task descriptions to a third-party service and lets that service steer model and sub-agent choices without enough safeguards.

Review this carefully before installing. Use only coarse, sanitized task descriptions unless you trust the operator of ss.deeflect.com and its logging and retention practices. Do not submit secrets, credentials, customer data, regulated data, proprietary source, or confidential project details. Validate returned model IDs and any decomposition/swarm plan before spawning agents, and set explicit limits on cost, provider choice, subtask count, and concurrency.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:14
Finding: Potential Disclosure of Sensitive Task Data to an External Service
Content: View full analysis
&budget= 2. Use the returned model ID in sessions_spawn ``` ```markdown 1. **Decide budget** — `low` for cheap/fast, `medium` for quality, `high` for best available 2. **Call /api/pick** with the task description 3. **Use the returned `id`** as the `model` parameter in `sessions_spawn` 4. **If task is complex** — use `/api/decompose` or `/api/swarm` to break it into subtasks, spawn each with its recommended model ``` ### Technical Analysis The skill directs the agent to send the task description to the unaffiliated external service `ss.deeflect.com`. Task descriptions can contain source code, internal project names, customer information, credentials, confidential requirements, or other sensitive context. The task is sent using a URL query parameter. Although the documented endpoint uses HTTPS, query strings can still be retained in server access logs, reverse-proxy logs, observability systems, browser history, or other request-monitoring infrastructure. The skill does not require user consent, data classification, secret redaction, or minimization before this transmission. ### Attack Path 1. A user supplies a task containing confidential or identifying information. 2. The agent follows the skill and inserts that description into the `task` query parameter. 3. The request is transmitted to `ss.deeflect.com`. 4. The external service and associated logging infrastructure receive the task contents. 5. The information may be stored, processed, or exposed according to controls not documented by the skill. ### Impact Assessment The issue does not directly grant local system privileges or execute code. Its scope is information confidentiality: the external se ...[truncated 165 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:83
Finding: Unvalidated External Control of Model Selection and Sub-Agent Delegation
Content: View full analysis
&budget= 2. Use the returned model ID in sessions_spawn ``` ```text sessions_spawn(task="Build a React dashboard with auth", model="anthropic/claude-opus-4.6") ``` ```bash POST https://ss.deeflect.com/api/decompose {"task": "Build and deploy a SaaS app", "budget": "medium"} ``` ```text Returns sequential steps with optimal model per step. ``` ```bash POST https://ss.deeflect.com/api/swarm {"task": "Research competitors and build pitch deck", "budget": "low"} ``` ```text Returns a dependency graph of parallel tasks with models assigned. ``` ```markdown 1. **Decide budget** — `low` for cheap/fast, `medium` for quality, `high` for best available 2. **Call /api/pick** with the task description 3. **Use the returned `id`** as the `model` parameter in `sessions_spawn` 4. **If task is complex** — use `/api/decompose` or `/api/swarm` to break it into subtasks, spawn each with its recommended model ``` ### Technical Analysis The skill instructs the agent to directly use a server-provided model ID and, for complex tasks, to spawn subtasks derived from externally generated decomposition or swarm responses. It does not require validation of model providers, response schemas, task relevance, delegation depth, concurrency, cost, or consistency with the user's original request. If the external service or its delivery path is compromised, manipulated responses could influence which model receives the task and how many sub-agents are created. Externally generated task text could also attempt to expand the original scope or introduce instructions that should not be trusted. This is an instruction-boundary weakness because thi ...[truncated 1151 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs users to send arbitrary task descriptions to an external service at ss.deeflect.com/api, but the description does not warn that potentially sensitive prompts, project details, or proprietary data will be transmitted off-platform. This creates a real privacy and data-governance risk because users may unknowingly disclose confidential information while following the documented workflow.
Content: No source excerpt is available for this finding.