ADI Decision Engine

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:36 AM UTC
• Version: 0.1.0

Overview

This skill is a local decision-ranking helper, but it deserves review because it can auto-rank high-impact choices like hiring and its hiring guidance is under-scoped.

Install only if you are comfortable with a local ADI runtime ranking decision inputs. Avoid implicit use for hiring or other regulated decisions unless you add your own compliance review, lawful job-related criteria, and explicit user approval before relying on rankings. Do not feed confidential candidate or business data through the CLI fallback on shared machines unless temporary local files are acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description promises a decision-support/MCDA capability that analyzes options and produces explainable rankings or recommendations. The supplied code does not perform any ranking, scoring, comparison, optimization, or recommendation logic. Instead, it only parses a required --input argument, reads JSON from file/stdin, validates the request structure through helper functions, and reports counts of options/criteria plus policy name. This is a materially different primary purpose: request validation rather than decision analysis. There is no evidence of undeclared sensitive resource access, but the functional mismatch is clear.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to use local scripts and a Python runtime, which implies shell execution and file reads, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization gap where an orchestrator or reviewer cannot easily verify or constrain what capabilities the skill expects, increasing the risk of unintended file access or command execution.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables implicit invocation with no visible activation constraints, so the platform may auto-trigger this decision engine in situations broader than the author intended. Because the skill produces structured recommendations and rankings, unintended invocation could influence user decisions, procurement choices, or prioritization workflows without clear user consent or narrow scoping.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The hiring use case suggests 'must include language or location requirements' as a typical constraint without framing these as optional, job-related, and jurisdiction-dependent. In a decision-support skill, this can normalize use of potentially sensitive or legally risky screening criteria, leading users to encode discriminatory constraints into automated ranking workflows.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code serializes request data to a temporary JSON file on disk before validation, which can expose potentially sensitive decision inputs to other local processes, backup systems, crash recovery artifacts, or later forensic recovery. Although the file is deleted afterward, temporary disk writes still create a confidentiality risk, especially in shared or multi-tenant environments.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

json.dump(data, handle, ensure_ascii=False, indent=2)
        temp_path = handle.name

    result = subprocess.run(
        [cli, "validate", temp_path],
        capture_output=True,
        text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code invokes an external command to validate the request, but there is no print/log message, confirmation, or explanatory comment/docstring warning that a subprocess will be run. This matters because shell or subprocess execution is safety-relevant under the audit criteria.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Decision execution payloads are written to a temporary JSON file on disk, creating the same confidentiality and residual-data risk as the validation path. In this skill context, decision requests may include vendor, procurement, hiring, or prioritization data, making temporary local disclosure more sensitive than generic application metadata.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The function executes an external CLI to make a decision, but the code contains no confirmation prompt, visible logging, or explanatory comment/docstring warning about that subprocess action. Under the stated rules, subprocess execution in code should be disclosed unless already clearly warned elsewhere.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if policy_override:
        command.extend(["--policy", policy_override])

    result = subprocess.run(command, capture_output=True, text=True, check=False)
    Path(temp_path).unlink(missing_ok=True)
    if result.returncode != 0:
        raise AdiRuntimeError(result.stderr.strip() or result.stdout.strip() or "ADI execution failed.")

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.