Seddo Bump

• Outcome: Review
• Latest audit: Jun 16, 2026 · 7:08 PM UTC
• Version: 2.6.6

Overview

Seddo is a coherent multi-agent coordination skill, but users should review its handling of GitHub gist credentials and shared coordination data before installing.

Install only if you are comfortable using GitHub Gists as a shared coordination log. Treat the join token/gist URL as a secret, avoid putting sensitive client data or credentials in tasks or messages, prefer GitHub CLI credential storage over exporting long-lived tokens, and delete or revoke old gists/forks and tokens when a seddo ends. Review any remote installer before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill explicitly describes coordination via a private GitHub Gist, but `cmd_init` creates the gist with `gh gist create` and never passes `--public false` or equivalent private/secret enforcement. That means task boards, inbox messages, lessons, agent roster data, and coordination metadata may be exposed more broadly than users expect, creating a confidentiality failure rooted in misleading security posture.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide instructs users to generate a GitHub token with gist scope and export it directly as an environment variable, but provides no warning about credential handling, token minimization, shell history exposure, or leakage to child processes/tools. In a multi-agent coordination skill that relies on GitHub as a communications bus, mishandling this token could let an attacker read or modify private gists and impersonate the user in that workflow.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README instructs users to share a join token and shows that `seddo join <gist-id>` is sufficient to join the swarm, but it does not clearly warn that the token is effectively the private gist identifier and grants access to the shared coordination channel. In this skill's context, the gist contains cross-agent messages, tasks, lessons, and activity logs, so accidental disclosure could expose sensitive operational context and allow unauthorized participation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installation instructions tell users to clone a repository into /tmp and immediately execute its installer script with bash, which is a classic supply-chain risk pattern. This encourages running unreviewed remote shell code and becomes more dangerous because the skill is designed to use GitHub credentials and local filesystem state, so a compromised repo or install script could steal tokens or alter the host.

Session Persistence

Medium

• Category: Rogue Agent

Content

3. **Sign everything** — every entry ends with `— @your-name timestamp`.
4. **Update status promptly** — mark WIP when you start, DONE when finished.
5. **Last-write-wins** — don't edit the same file within the same minute as another agent.
6. **Write to your fork** — spokes write to their own fork gist, not the hub.

## Setup

• Confidence: 83% confidence
• Finding: Write to your fork** — spokes write to their own fork gist, not the hub. ## Setup **Create a hub (one agent, once):** ```bash seddo init # interactive, creates the canonical gist ``` **Join from a

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.