ADI Decision Engine

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:36 AM UTC
• Version: 0.1.0

Overview

This skill is a local decision-ranking helper, but it deserves review because it can auto-rank high-impact choices like hiring and its hiring guidance is under-scoped.

Install only if you are comfortable with a local ADI runtime ranking decision inputs. Avoid implicit use for hiring or other regulated decisions unless you add your own compliance review, lawful job-related criteria, and explicit user approval before relying on rankings. Do not feed confidential candidate or business data through the CLI fallback on shared machines unless temporary local files are acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description promises a decision-support/MCDA capability that analyzes options and produces explainable rankings or recommendations. The supplied code does not perform any ranking, scoring, comparison, optimization, or recommendation logic. Instead, it only parses a required --input argument, reads JSON from file/stdin, validates the request structure through helper functions, and reports counts of options/criteria plus policy name. This is a materially different primary purpose: request validation rather than decision analysis. There is no evidence of undeclared sensitive resource access, but the functional mismatch is clear.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to use local scripts and a Python runtime, which implies shell execution and file reads, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization gap where an orchestrator or reviewer cannot easily verify or constrain what capabilities the skill expects, increasing the risk of unintended file access or command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill enables implicit invocation with no visible activation constraints, so the platform may auto-trigger this decision engine in situations broader than the author intended. Because the skill produces structured recommendations and rankings, unintended invocation could influence user decisions, procurement choices, or prioritization workflows without clear user consent or narrow scoping.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The hiring use case suggests 'must include language or location requirements' as a typical constraint without framing these as optional, job-related, and jurisdiction-dependent. In a decision-support skill, this can normalize use of potentially sensitive or legally risky screening criteria, leading users to encode discriminatory constraints into automated ranking workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code serializes request data to a temporary JSON file on disk before validation, which can expose potentially sensitive decision inputs to other local processes, backup systems, crash recovery artifacts, or later forensic recovery. Although the file is deleted afterward, temporary disk writes still create a confidentiality risk, especially in shared or multi-tenant environments.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_runtime.py (reported line 72)May include surrounding context.

python

json.dump(data, handle, ensure_ascii=False, indent=2)
        temp_path = handle.name

    result = subprocess.run(
        [cli, "validate", temp_path],
        capture_output=True,
        text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code invokes an external command to validate the request, but there is no print/log message, confirmation, or explanatory comment/docstring warning that a subprocess will be run. This matters because shell or subprocess execution is safety-relevant under the audit criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Decision execution payloads are written to a temporary JSON file on disk, creating the same confidentiality and residual-data risk as the validation path. In this skill context, decision requests may include vendor, procurement, hiring, or prioritization data, making temporary local disclosure more sensitive than generic application metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The function executes an external CLI to make a decision, but the code contains no confirmation prompt, visible logging, or explanatory comment/docstring warning about that subprocess action. Under the stated rules, subprocess execution in code should be disclosed unless already clearly warned elsewhere.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_runtime.py (reported line 105)May include surrounding context.

python

if policy_override:
        command.extend(["--policy", policy_override])

    result = subprocess.run(command, capture_output=True, text=True, check=False)
    Path(temp_path).unlink(missing_ok=True)
    if result.returncode != 0:
        raise AdiRuntimeError(result.stderr.strip() or result.stdout.strip() or "ADI execution failed.")

Static analysis

No suspicious patterns detected.