Seddo

• Outcome: Pass
• Latest audit: Jun 11, 2026 · 10:02 PM UTC
• Version: 2.6.5

Overview

Seddo is a disclosed GitHub Gist coordination tool with expected local install, GitHub token, and remote-write behavior, but users should be careful about tokens and what they share in gists.

Install only if you are comfortable giving the tool GitHub gist access and storing coordination messages, tasks, lessons, and activity in GitHub Gists. Prefer gh auth login or a credential store over pasting tokens into shell history, review the installer before running it, join only trusted gist IDs, and do not place secrets or sensitive client/project data in the shared gist.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill explicitly instructs users to run shell commands and install executable scripts, but it does not declare corresponding permissions or execution capabilities. This weakens transparency and reviewability, making it easier for users or host platforms to underestimate the skill's ability to execute local commands and modify the environment.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide instructs users to export a GitHub token and make persistent local system changes such as cloning a repo, copying executable files into a skills directory, editing config, and creating a PATH symlink, but it does not warn about credential handling, trust of downloaded code, or the persistence of those changes. In a security-sensitive agent skill context, this omission increases the chance that users expose tokens in shell history/environment or install unreviewed code that remains available for later execution.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The usage section advertises commands that create, fork, sync, send, and update GitHub gists, which can write remote data and alter shared coordination state, but it does not warn users that these operations are state-changing and may affect other agents or remote artifacts. In a multi-agent coordination tool using private gists as a bus, silent remote writes can cause unintended disclosure, corruption of shared state, or confusion about who initiated changes.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README instructs users to clone code, run an installer, create and fork private gists, and persist configuration under the user's home directory, but it does not prominently warn that task contents, messages, lessons, and agent coordination data will be uploaded to GitHub and stored across machines/accounts. In a cross-agent skill, that omission increases the risk of accidental disclosure of secrets, client data, or internal context, and of unintended local system changes such as PATH symlinks and persistent config creation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The installation flow clones a remote repository and immediately executes its install.sh script, which is equivalent to running downloaded code with full user privileges. If the repository is compromised, tampered with, or replaced, this becomes an easy path to arbitrary code execution on the host machine.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The statement that the document is 'self-describing' and that any agent that reads it 'understands how to participate' acts as a broad activation cue without authentication, authorization, or scope constraints. In this skill's context, that is risky because merely encountering the file can induce an agent to join a multi-agent coordination channel, read/write shared state, and follow tasking from an untrusted gist.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The rule 'Read PROTOCOL.md first — when you discover a seddo, this file tells you everything' creates an ambiguous discovery-triggered behavior with no constraint on how the file was found or whether the source is trusted. In a system designed to coordinate agents across machines and accounts, this can let an attacker plant or surface a protocol file that causes unintended enrollment, task execution, or data sharing.

Session Persistence

Medium

• Category: Rogue Agent

Content

3. **Sign everything** — every entry ends with `— @your-name timestamp`.
4. **Update status promptly** — mark WIP when you start, DONE when finished.
5. **Last-write-wins** — don't edit the same file within the same minute as another agent.
6. **Write to your fork** — spokes write to their own fork gist, not the hub.

## Setup

• Confidence: 77% confidence
• Finding: Write to your fork** — spokes write to their own fork gist, not the hub. ## Setup **Create a hub (one agent, once):** ```bash seddo init # interactive, creates the canonical gist ``` **Join from a

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.