Security audit

Agent Harness Architect

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only skill is mostly about agent harness planning, but it also encourages persistent agent behavior changes, broad commits, and self-updates without clear user approval.

Review this skill carefully before installing. Treat its generated CLAUDE.md, AGENTS.md, output-gate, progress-file, and self-improvement snippets as drafts only; avoid the NO_REPLY output gate, replace git add -A with explicit file staging after diff review, and require human approval before any persistent agent configuration, learning log, or skill/template change.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:128
Finding: Persistent Output-Control Instruction Injection
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:113
Finding: Persistent Agent State and Instruction Modification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:145
Finding: Overbroad Git Staging May Commit Unrelated Sensitive Files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The description promises auto-generated, directly deployable artifacts without clearly warning that these outputs may alter project behavior or persist state. In practice, users or agents may apply these files mechanically, introducing unreviewed operational changes into repositories or runtime workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger condition includes broad phrases like optimizing an agent architecture, which can cause the skill to activate for generic requests not intended for this workflow. Over-broad activation increases the chance of irrelevant instructions being injected into unrelated tasks, leading to unintended process or state modifications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The session protocol instructs repeated git commits after each task without an explicit warning or approval checkpoint, encouraging repository mutation as a default behavior. In automated environments, this can create noisy history, commit sensitive intermediate data, or persist accidental changes without human review.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The self-improvement section instructs the skill to write learning logs and update itself when certain conditions occur, expanding behavior beyond the user-requested harness diagnosis and artifact generation. In an agent setting, this can cause unauthorized state changes, persistence, and scope creep, especially if the agent has filesystem access or can modify skill artifacts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The user-facing instructions and examples are presented in Chinese, but the file does not state that the skill is Chinese-only or allow the user to choose another language. This can violate a language/locale policy if users are expected to receive content in their preferred language unless they opt in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.