Security audit

Skill Orchestration Core

Security checks for vulnerabilities and agentic risk

Overview

This is a real workflow helper, but it gives project-controlled workflow files too much influence over delegated agent work and file writes.

Review before installing. Use this only on trusted or reviewed DESIGN.md files, avoid running auto-fix unless the project is under version control, and do not let generated delegate_task context run with broad terminal/file/web access without user approval and project-root path limits. Also expect most documentation and CLI output to be Chinese.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: scripts/workflow_orchestrator.py:67
Finding: Untrusted Workflow Content Is Converted into Privileged Agent Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/output_validator.py:205
Finding: Project-Controlled Output Paths Permit Writes Outside the Project Root
Content: View full analysis
Remediation: View remediation

other

Warning

Location: references/template-authoring-and-recovery.md:28
Finding: Cross-Session Recovery Instructions Encourage Broad Access to Conversation History
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: 该代码与声明中的“上下文管理”部分高度一致：它负责在项目级别持久化上下文、共享数据、记录当前 skill、完成列表和进度，并通过文件锁保证并发访问安全。但声明称其是“编排核心”，且包括“流程编排、质量保证”。从实际代码看，并没有任务调度、流程控制、分支决策、依赖解析、执行管线管理等更完整的编排能力；也没有校验、测试、审计、质量检查等“质量保证”功能。因此描述比实际能力更宽，尤其在“质量保证”方面明显不符，在“流程编排”方面也只有轻量状态跟踪而非完整实现。综合判断为存在描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 声明描述的是“编排核心—上下文管理、流程编排、质量保证”，听起来像一个 orchestration/core 组件。但实际代码并未实现流程编排或上下文管理核心逻辑，而是一个面向命令行的输出验证器。它的主要功能是读取 DESIGN.md 和项目输出文件、执行规则校验、生成报告，并在 auto-fix 模式下修改文件系统。这与“编排核心”这一主要用途存在明显偏差。虽然‘质量保证’与验证器部分相关，但代码还包含未在描述中体现的重要能力：文件系统扫描、从上下文文件读取内容、自动修复写文件/建目录、覆盖率估算和安全检查。因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents substantial file read/write behavior and workflow execution patterns, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent environment, missing capability scoping increases the chance that the skill is executed with broader filesystem access than intended, enabling unintended modification of project files or sensitive local data exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description explicitly states the skill in Chinese and the document consistently presents the skill as Chinese-first without any opt-in or user choice for language. The policy for this audit flags locale or language constraints when they are imposed without user selection or clear region-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file is written entirely in Chinese, including the title and all instructional content, with no indication that the language choice is optional or that the skill is intended only for a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains natural-language docstrings and CLI messages in Chinese throughout, establishing a fixed language for interaction. The policy explicitly calls out locale/language constraints as violations when the skill does not offer user opt-in or choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and all user-facing CLI messages are written only in Chinese, which effectively fixes the interaction language for users of this skill. There is no indication of user opt-in, locale selection, or documentation that this is intentionally limited to a Chinese-specific context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes the skill as orchestration core for context management, workflow orchestration, and quality assurance, and this file's docstring presents it as an output validator. However, the code does not only validate output quality: auto_fix creates directories/files and appends placeholder content to documentation outputs. That is behavior-changing remediation, not just validation, and materially expands the skill's operational scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code file includes safety-relevant write operations: creating directories, touching files, writing new files, and appending content to existing markdown files during auto_fix. While the function name suggests modification, the execution path itself provides no prior confirmation prompt or explicit warning before making filesystem changes, and the module docstring does not disclose these side effects.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: A quality/output validator is expected to inspect and report on outputs. Here, the code actively writes placeholder sections into markdown files and creates missing output files/directories, which is a separate content-generation/remediation capability rather than a direct requirement for validation. This is especially clear where it inserts generic TODO sections and seed content instead of just reporting findings.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This Python skill contains natural-language documentation and CLI usage text entirely in Chinese, which imposes a specific language on users without any opt-in or alternative locale. The policy explicitly flags language or locale constraints when the skill does not offer user choice or clearly document a justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file contains user-facing instructions exclusively in Chinese, including the title, steps, command explanations, and linked documentation references. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable issue unless the locale restriction is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · templates/QUICKSTART.md (reported line 11)May include surrounding context.
bash
# 创建项目目录 mkdir my-project cd my-project # 复制示例 DESIGN.md

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · templates/README.md (reported line 11)May include surrounding context.
bash
# 创建项目目录 mkdir my-project cd my-project # 复制示例 DESIGN.md

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file explicitly describes that the validator reads project files and can perform automatic fixes via validator.auto_fix("writing-plans"), but it does not warn users that running these commands may modify files in their project. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system integrity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The documented CLI includes context_manager.py clear, workflow_orchestrator.py restore, and output_validator.py auto-fix, all of which can affect stored state or project contents, but the README provides no caution about potential data loss or overwriting. In a markdown skill description, omitting such warnings for destructive or state-altering behavior matches SQP-2.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · templates/README.md (reported line 186)May include surrounding context.
bash
# 创建项目 mkdir simple-project cd simple-project # 创建 DESIGN.md

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description and the entire design guidance are written in Chinese, with no indication that other languages are supported or that the user can opt into this locale. This can constitute a language/locale policy violation because the skill appears to impose a specific language by default rather than offering a choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file presents the skill description and operational guidance exclusively in Chinese, including the title, overview, workflow, and validation sections. The policy requires flagging language or locale constraints when a specific language is effectively forced without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The heading includes the instruction "输出" alongside the skill name, indicating the skill is intended to produce output in Chinese. There is no indication that the user can choose another language or that this locale restriction is justified, which creates a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire technical design document is written in Chinese, and there is no indication that the language choice is optional, user-selected, or required for a region-specific purpose. This can violate language/locale policy when a skill or its documentation implicitly enforces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description and the entire instructional content are written in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. This creates a natural-language locale policy concern because the skill effectively enforces a language without user opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The top-level docstring says this is an output validator that 'truly reads project files for validation,' which frames the tool as inspection-oriented. The implementation later performs file creation and content appends in auto_fix and _append_to_output, so the documentation understates and partially contradicts the side-effecting behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring and all printed status messages are written in Chinese, which imposes a specific language on users running the script. The file does not offer an opt-in language selection or explain that the skill is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: All user-facing instructional content in this file is presented in Chinese, and there is no indication that the skill is region-specific or that users may choose another language. Per SQP-3, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.