Security audit

Codifica

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Git-based task protocol, but it asks agents to trust repository-controlled instructions and automatically commit or push persistent state.

Install only in repositories where you trust the Codifica files and the Git remote. Before using it, confirm the remote and branch, review any state/spec files it will read, and prefer manually approving commits and pushes so execution notes do not publish secrets, sensitive paths, or unintended project details.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:15
Finding: Repository-Controlled Files Can Hijack Agent Instructions
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:58
Finding: Automatic Git State Mutation Enables Persistent Agent Poisoning and Unauthorized Publication
Content: View full analysis
` 3. Set `claimed_at: ` 4. Add a `state_transitions` entry recording the claim Commit all these changes together. If you are working with a remote, push immediately. If the push fails (another agent claimed first), do NOT start work — pull, re-evaluate, and pick a different task. An `unassigned` task in `in_progress` is a protocol violation. ``` Related mandatory rules include: ```markdown - Pull before reading state files. Pull before writing changes. - Claim tasks with a single commit before starting work. - If your claim push fails, do not start — pick a different task. ``` The Skill also requires execution notes, artifacts, state transitions, and task completion details to be committed to the repository. ### Technical Analysis The Skill mandates persistent repository mutations and immediate publication to a configured Git remote without requiring confirmation of the remote identity, proposed diff, included data, or current user authorization. These state files are subsequently read by other agents as task context. Therefore, malicious or misleading instructions written into the state repository can persist across sessions and influence future agents. Mandatory pulling before reading also imports newly supplied remote content before that content has been validated as trusted. The immediate-push requirement creates an additional access-control concern. An agent may use credentials already available in its environment to publish task metadata, execution notes, or unintended changes. Although the ...[truncated 1943 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.