Module Analyzer Generate Doc

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:31 AM UTC
• Version: 1.0.5

Overview

The skill mostly matches its documentation purpose, but it asks to persist its own operating rules in TOOLS.md and includes a risky PowerShell generate command, so users should review it before use.

Use this only if you are comfortable with the agent reading the target module's source code and generating documentation, state, and logs under .ai-doc. Before installing or running it, do not allow it to modify TOOLS.md unless you explicitly want persistent defaults for future agent sessions, and avoid npm run generate until the PowerShell bypass command is removed or replaced with a reviewed script.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:606

Finding

Persistent Agent Configuration Modification Beyond Task Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:606-621
Secondary Location: README.md:201
Vulnerability Type: Persistent agent-state modification
Risk Level: Medium

markdown

Add the following to `TOOLS.md`:

### Module Analyzer - Java Single-Module Documentation Generator

- Default chunk size: 10-16 files per subagent
- Maximum parallelism: 5-6 subagents
- Context threshold: warning at 40%, forced compression at 50%
- Compression frequency: every 2-3 files
- Simple-file threshold: 50 lines
- Timeout: 300-900 seconds, depending on chunk size
- Retry policy: up to 3 attempts with exponential backoff
- Progress reporting: every 20 minutes
- Checkpoint resume: automatically save state
- File-read failure handling: record and retry
- Secondary scan: automatically identify and process omissions

Technical Analysis

The Skill instructs the agent to write Skill-controlled operational rules into TOOLS.md. This is unnecessary for the stated task of generating documentation under .ai-doc and crosses the expected boundary between task-local state and persistent agent configuration.

Because TOOLS.md can be loaded by later agent sessions, the settings may continue influencing subagent counts, retry behavior, automatic scanning, and task execution after the original documentation request ends. The supplied values are not independently malicious, but the write primitive establishes an unsafe pattern in which a Skill can persist its own instructions outside its package and task-specific output directory.

This behavior best matches agent memory poisoning because Skill-provided rules are written into persistent state that may affect future sessions.

Attack Path

1. A user activates the Skill to document a Java/Maven module.
2. The agent follows the configuration section in SKILL.md.
3. The agent appends the Skill-provided settings to persistent TOOLS.md.
4. A later session ...[truncated 1030 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to modify TOOLS.md from both SKILL.md and README.md.
2. Keep configuration inside Skill-local metadata, such as package.json, or maintain it only in task-local runtime state.
3. Restrict generated files to the documented .ai-doc output directory.
4. If persistent configuration is genuinely optional, show the exact target path and proposed diff before writing anything.
5. Require explicit, informed user approval for each persistent configuration change.
6. Mark generated configuration with its source, version, and removal procedure.
7. Validate that configuration values cannot introduce commands, tool aliases, executable hooks, or instructions overriding platform safety controls.

T09 · Insecure Skill Coding Practices

Note

• Location: package.json:19

Finding

PowerShell Execution-Policy Bypass in Package Script

Content

View full analysis

Vulnerability Details

File Location: package.json:19
Vulnerability Type: Unsafe command execution configuration
Risk Level: Low

json

"generate": "powershell -ExecutionPolicy Bypass -File scripts/generate-module-doc.ps1"

Technical Analysis

The package command launches PowerShell with -ExecutionPolicy Bypass. This suppresses the normal execution-policy check for the referenced process and permits an otherwise restricted PowerShell script to run.

The referenced file, scripts/generate-module-doc.ps1, is absent from the audited package. Consequently, the command currently fails rather than executing a packaged payload. Nevertheless, the configuration creates an unsafe execution path if that location is later populated, supplied by an incomplete installation, or introduced in a future release without adequate review.

Execution policy is not a complete security boundary, but disabling it by default removes a defense-in-depth control without a demonstrated requirement. The behavior is also inconsistent with the package’s documentation-oriented purpose and its claims that shell operations are limited to read-only file access.

Attack Path

1. A user or automated system invokes npm run generate.
2. The package manager launches PowerShell with execution-policy enforcement bypassed.
3. PowerShell resolves scripts/generate-module-doc.ps1.
4. If an attacker, compromised update, or unsafe installation process has placed a script at that path, PowerShell executes it without the normal policy check.
5. The script runs with the privileges of the user who invoked the package command.

In the audited package, step 4 cannot complete because the referenced script is missing. Exploitation therefore depends on the path being populated later.

Impact Assessment

A supplied script would inherit the invoking user’s local privileges and could access any files, environment variables, network resources, or ...[truncated 411 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove -ExecutionPolicy Bypass from the package command.
2. Remove the generate script entirely if generation is instruction-driven and no implementation is intended.
3. If a PowerShell implementation is required, include the referenced script in the package and subject it to security review.
4. Digitally sign the PowerShell script where enterprise execution policies require trusted signatures.
5. Resolve the script path relative to a verified package directory and reject symbolic-link or path-substitution conditions where applicable.
6. Document all filesystem writes, subprocesses, and network operations performed by the script.
7. Add an automated packaging test that fails when a declared executable entry point is absent.
8. Ensure shell operations follow least privilege and do not disable platform security controls by default.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file presents the substantive report content in Chinese, including headings and remediation details, without any indication that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file contains the skill title, description, and operational guidance primarily in Chinese, and later confirmation prompts are also presented only in Chinese. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation unless the skill explicitly offers a language choice or documents a justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown template is entirely framed in Chinese, including the title placeholder and description for non-technical readers, which effectively prescribes a specific output language. The file does not provide any opt-in, language choice, or documented region-specific justification, so it matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file is natural-language content, so language-policy checks apply. The document consistently mandates Chinese-language output and examples, but does not provide user opt-in, multilingual alternatives, or a stated region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file includes large sections of bilingual content, with many instructions and descriptions presented in Chinese alongside English. Under the stated policy, forcing or assuming a specific language/locale without explicit user opt-in can be a natural-language policy issue, and this file does not explain any user language choice or region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The top-level description leads with Chinese-only promotional text, and multiple sections throughout the README are bilingual but implicitly centered on Chinese as the primary presentation language. Because the skill does not state that users may choose their preferred language for generated output or interaction, this can be interpreted as a locale/language default without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.