Security audit

LLM Supervisor

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims at a high level, but its promised confirmation gate for local code work is weak enough that code tasks may proceed without deliberate user approval.

Review before installing if you rely on strict approval before local-model code changes. The skill is not showing exfiltration or destructive behavior, but its confirmation control should be hardened or treated as best-effort rather than a dependable safety gate.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: hooks/beforeTaskExecute.ts:23
Finding: Local Code Execution Confirmation Can Be Bypassed
Content: View full analysis
; } ``` ### Technical Analysis The local-code safety control can be bypassed through three related weaknesses: 1. **Fail-open intent filtering** The hook only protects tasks whose `intent` exactly matches one of eight hardcoded values. If the intent is absent, misspelled, renamed by the platform, or represented by another code-related intent, the function returns without requiring confirmation. The available `task.kind` property is also ignored. 2. **Substring-based confirmation** The code treats the task as confirmed whenever the configured phrase appears anywhere in the latest user message. This does not prov ...[truncated 2676 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.