Intent-Engineering

• Outcome: Review
• Latest audit: May 28, 2026 · 8:22 AM UTC
• Version: 1.0.0

Overview

This skill is not proven malicious, but it broadly governs agent behavior and includes unsafe workflow code that can run arbitrary Python from workflow conditions.

Install only after careful review. Do not run the orchestrator on untrusted workflow definitions unless eval is removed or replaced with a constrained condition parser. Require explicit user approval for registry changes, self-modification, and high-impact workflows, and redact or avoid storing secrets, personal data, and exact prompts in audit logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

eval() call detected

High

• Category: Dangerous Code Execution

Content

f"steps[{step_id}].outputs",
                    json.dumps(result.outputs)
                )
            return eval(eval_str)
        except Exception as e:
            self.logger.warning(f"Failed to evaluate condition: {e}")
            return False

• Confidence: 99% confidence
• Finding: The orchestrator evaluates workflow-supplied condition strings with Python's eval(), which enables arbitrary code execution if an attacker can influence workflow configuration. In this context, workflow definitions are effectively untrusted input, so a crafted condition could execute OS commands, access files, or tamper with process state rather than merely perform branching logic.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill describes behavior that requires reading local files such as the skill registry, shared intent, and data contracts, but it does not declare corresponding permissions. Undeclared file access weakens governance and user visibility, especially for a meta-skill positioned to influence how the agent operates across other skills.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description presents a governance/meta-framework role, but the referenced behavior includes powerful operational capabilities: disk inspection, workflow execution, CLI exposure, and especially evaluating workflow conditions via Python eval. This mismatch is dangerous because users may authorize or invoke the skill expecting passive planning/governance while it can actually execute logic and inspect files, increasing the risk of unintended code execution and overbroad access.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Conditional workflow support grants arbitrary Python execution through attacker-controlled condition strings, which far exceeds the stated need of evaluating workflow branches. Because this file is an orchestrator that may execute many skills and process sensitive data, code execution here can compromise the entire skill ecosystem, not just one branch decision.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The comment explicitly acknowledges that a safer evaluation method is needed, yet the implementation still relies on unsafe eval later in the file. This does not create a separate exploit primitive beyond the eval itself, but it is strong evidence that the dangerous behavior is known and unresolved, increasing concern about secure design rigor.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill says that when a user asks the agent to 'build something,' the agent uses this skill to guide its own reasoning and implementation. That broad invocation surface could cause the skill to activate for many ordinary requests, effectively giving this meta-skill pervasive influence over agent behavior and increasing the blast radius of any unsafe orchestration or self-modification behavior.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The workflow execution record stores and returns full inputs, step inputs, outputs, and error strings, which can expose sensitive user data or secrets to logs, downstream consumers, or operators without redaction. In an orchestrator that composes multiple skills, aggregated execution traces can centralize and amplify data exposure across the whole workflow.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The template explicitly instructs operators to record the user name/ID and the exact user prompt, but provides no guidance to avoid secrets, personal data, regulated data, or other sensitive content. In an agent-governance context, audit logs are likely to be retained, shared, or reviewed broadly, so this design can turn transient sensitive inputs into durable records and increase exposure through over-collection.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/orchestrator.py:459