Feedback-Loop-v2

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:14 AM UTC
• Version: 1.0.1

Overview

The skill’s core purpose is coherent, but its custom suggestion-rule feature can execute arbitrary Python code from a user-supplied rules file.

Review before installing. Use only trusted suggestion_rules files, do not accept rules from untrusted sources, and prefer removing or replacing the Python-evaluable rule conditions before running this in automated or privileged environments. Expect the skill to create analysis/report/update JSON files in the selected output directory.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/analyzer.py:138

Finding

Arbitrary Code Execution Through User-Controlled Suggestion Rule Conditions

Content

View full analysis

Remediation

View remediation

= right, "gt": lambda left, right: left > right, } ``` 3. Allow only the documented metrics: - `pass_rate` - `duration_ms` - `failure_count` - `regression_detected` 4. Validate the entire rules document against a strict schema before processing it. Reject: - Unknown fields. - Unsupported operators. - Incorrect value types. - Missing required fields. - Invalid priority values. - Excessively long strings or rule collections. 5. If expression syntax must be retained, parse it with `ast.parse()` and permit only a narrowly defined set of nodes, such as names, constants, Boolean operators, and comparison operators. Reject calls, attributes, subscripts, comprehensions, lambdas, imports, and all other executable constructs. Structured rules remain the safer design. 6. Replace the broad `except Exception: pass` behavior with explicit validation errors and safe logging so malformed or rejected conditions remain observable. 7. Treat custom rule files as untrusted input. Apply file ownership and integrity controls when rules are used in automated or privileged workflows. 8. Add regression tests proving that expressions containing function calls, imports, attribute access, and other executable syntax are rejected without side effects. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code substantially matches the core analysis-related parts of the description: performance analysis, regression detection, improvement suggestions, regression test generation, and goal/alignment checks are all implemented. However, the description overstates several capabilities that are not present in this code chunk. Most notably, this script does not perform observation/monitoring itself; it only analyzes an input file. It also does not generate any cryptographic signature or other signed report, only a plain JSON output. Finally, the claimed integration with intent-engineering and dark-factory is not evidenced here. Because these are meaningful declared capabilities rather than minor implementation details, the description does not accurately represent this specific code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code chunk is narrowly scoped to building an observation record. It parses inputs, extracts metrics/failures from JSON or text, optionally enriches the observation with dark-factory and intent-engineering artifacts, and outputs observation.json. While this partially matches the 'observes any system or execution' portion and supports standalone/integrated modes, it does not implement the key advertised capabilities of analysis-driven improvement, suggestion generation, regression test generation, goal alignment checking, or signed reporting. Therefore the declared description materially overstates what this code actually does.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This finding correctly identifies the core issue: externally supplied suggestion-rules are executed as Python expressions. Because rules can be loaded from a user-provided file, anyone who can influence that file can run arbitrary code, read local files, or invoke system commands under the analyzer's privileges. The skill's 'self-improving' and configurable design increases exposure because external rule customization is a normal usage path.

Content

No source excerpt is available for this finding.

eval() call detected

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

This is a true code-execution vulnerability. The analyzer loads suggestion rules from an external JSON file and directly evaluates each rule's condition with Python eval(), so a crafted rules file can execute arbitrary Python in the context of the analyzer process. In this skill's context, the analyzer is explicitly designed to consume external override files, which makes exploitation more realistic rather than theoretical.

Content

Scanner excerpt · scripts/analyzer.py (reported line 142)May include surrounding context.

python

for rule in rules:
        condition = rule["condition"]
        try:
            if eval(condition, {}, context):
                key = rule["suggestion"][:60]
                if key not in seen:
                    suggestions.append({

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill explicitly describes scripts that read inputs and write multiple output artifacts, but it does not declare any tool scope or permissions boundaries. That mismatch is dangerous because downstream systems or users cannot tell what filesystem access the skill expects, increasing the chance of unintended file reads/writes when the skill is invoked in an automated environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill says it can analyze 'any system or execution' and is framed as universally applicable, which creates an overly broad activation boundary. In agentic environments, ambiguous scope can cause the skill to be invoked on sensitive logs, internal workflows, or high-risk contexts without clear user intent, leading to unnecessary exposure of data and unreviewed artifact generation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Automatic mode detection based on whatever files are present can silently change the skill's behavior and data handling. That is dangerous because the presence of outcome_report.json or specification.json may trigger richer processing of sensitive artifacts without an explicit mode selection or user acknowledgment, increasing the risk of unintended access, correlation, or output generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill states that it auto-generates and updates workflow artifacts, but it does not prominently warn users that files such as observation, analysis, reports, and updated specifications will be created or modified. In automated or shared workspaces, silent artifact generation can overwrite expected state, leak derived data into the filesystem, or contaminate downstream pipelines with unreviewed outputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation explicitly states that the skill will add new regression tests to updated_specification.json and automatically bump the specification version, but it does not clearly warn operators that running in Full Triad mode causes write-side effects to specification artifacts. In a self-improving loop, silent mutation of spec files can undermine change control, contaminate trusted inputs for later runs, and allow unintended propagation of bad or attacker-influenced updates.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The module documentation presents the analyzer as data-driven and universally applicable to observation files, implying normal analysis behavior. In practice, when paired with custom suggestion rules, the analyzer evaluates rule strings as Python code, which contradicts the apparent intent of a safe standalone analyzer operating on observation data.

Content

No source excerpt is available for this finding.

Tainted flow: 'analysis' from pathlib.Path.read_text (line 375, file read) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/analyzer.py (reported line 378)May include surrounding context.

python

analysis = analyze(observation, weights, alignment_values, suggestion_rules)

    out_path = Path(args.output)
    out_path.write_text(json.dumps(analysis, indent=2))

    log(f"Analysis ID:     {analysis['analysis_id']}", "OK")
    log(f"Performance:     {analysis['performance_score']:.4f}")

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code reads JSON from user-supplied paths and writes analysis results to an output path, which are safety-relevant filesystem operations for a code file. Although the CLI exposes the arguments, there is no explicit warning or confirmation about overwriting/creating files or about loading untrusted rule/config files; the logging occurs only after the operations are configured and does not serve as a prior disclosure.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/analyzer.py (reported line 364)May include surrounding context.

python

("alignment_values", "alignment_values.json", alignment_values),
    ]:
        ref_path = skill_dir / "references" / filename
        if ref_path.exists() and not getattr(args, attr.split("_")[0], None):
            try:
                loaded = json.loads(ref_path.read_text())
                if attr == "weights":