Project Developer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:56 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed workflow guide for developer agents; it contains no executable code or hidden credential handling, though it can direct normal git and task-board updates through separate skills.

Install this only for agents that are meant to operate as developer team members and already have appropriately scoped Git and task-manager skills. Review the branch naming, escalation-channel, HEARTBEAT.md write-back, and task-completion ownership rules before use so the agent does not update the wrong branch, queue, or board column.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 55% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/escalation_to_engineer.md (reported line 93)May include surrounding context.

md

- **Be specific, not vague.** "The spec is confusing" is unhelpful. "Spec section BE-012, paragraph 3: 'The endpoint should validate against the user schema' — which schema? I see two user schemas in the codebase (UserAuth and UserProfile) and the spec doesn't specify which one" is excellent.

- **Don't apologize for escalating.** If you've followed the decision tree and done your due diligence, escalating is the right thing to do. Spinning silently for hours is worse than asking for help.

- **Don't bundle unrelated issues.** If you have two separate blockers, send two separate escalation requests. Each should be self-contained and independently resolvable.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/pr_and_qa_handoff.md (reported line 164)May include surrounding context.

md

- **Vague "How to Test" section:** "Test the registration flow" is useless. "Navigate to /register, enter a valid email and matching passwords, submit, verify redirect to /dashboard and success toast" is useful.
- **Missing prerequisites:** If QA needs test data or a specific env var, not mentioning it wastes their time setting up.
- **Forgetting Known Limitations:** If you know social login isn't in this PR, say so. Otherwise QA will file it as missing.
- **Pushing to the branch while QA is mid-review without warning:** Tell QA before pushing during their review cycle. Unexpected changes invalidate their testing.
- **Arguing about scope in PR comments:** If there's a genuine scope dispute, escalate to the Engineer. PR comments are for technical discussion, not scope negotiation.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The trigger description is extremely broad, covering many normal development activities and heartbeat checks across projects. Over-broad activation criteria increase the chance the skill is invoked in the wrong context, which can make the agent take workflow actions, read project coordination files, or send status updates when a narrower skill or no skill should have been used.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file states that HEARTBEAT.md is operator-written setup state, but later instructs the agent to discover missing IDs and record them back into HEARTBEAT.md. This mismatch weakens trust boundaries around workspace state and can lead an agent to mutate supposedly operator-controlled coordination data, causing configuration drift or corruption of future heartbeat behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill defines incompatible branch naming schemes: earlier it prescribes role-specific feature/* prefixes, while later it requires a project/sprint/task format with one branch per sprint. Conflicting repository workflow instructions can cause agents to create or push to the wrong branch, bypass expected review flow, or overwrite unrelated work on a shared PR branch.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill gives conflicting escalation paths for contacting the engineer: one section says to use the project queue file as the record, while later sections instruct escalation via sessions_send. In an operational agent, contradictory control-flow instructions can cause missed or duplicated escalations, lost audit trail, and inconsistent handling of blockers, which may stall work or route sensitive project context through the wrong channel.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document says developers do not move certain tasks and the surrounding workflow assigns QA ownership of completion states, but L025 explicitly instructs the developer to move tasks from In Review to Completed after QA approval and merge. That directly conflicts with the earlier board definition where QA moves tasks to Completed after passing.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/git_workflow.md (reported line 115)May include surrounding context.

md

### PR Description

Follow the template in `pr_and_qa_handoff.md`. The PR description is your handoff document to QA — it needs to be thorough enough that QA can test your work without asking you what to do.

### Before Opening the PR

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The board structure defines standard columns as Backlog, In Progress, In Review, QA, Completed, and Blocked, but L126 tells the developer not to leave a blocked task 'in Features.' 'Features' is not one of the documented columns, so the instruction conflicts with the file's own documented workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.