Security audit

coding-tactics

Security checks for vulnerabilities and agentic risk

Overview

This is a coding workflow guide with broad but disclosed coding tools, and I found no hidden persistence, data theft, or deceptive behavior.

Install this only if you want a strict coding-method workflow that may slow work with confirmations, design docs, tests, and audits. Review the English-only requirement and security-secret guidance against your project standards, and keep normal workspace safeguards for any skill with Edit and Bash access.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (42)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description uses broad activation cues such as general development requests, implementation phases, and implicit task context, which can cause the skill to trigger on routine coding work beyond narrowly scoped user intent. In a skill that can read, edit, run shell commands, and fetch from the web, over-broad invocation increases the chance of unintended workflow capture and unauthorized method enforcement.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 94% confidence
Finding: The skill explicitly authorizes itself to select a method and proceed 'without asking the user to approve it again' when invoked by internal workflows. That creates autonomous decision-making and execution inside a broad coding skill, increasing the risk that the agent edits files or advances implementation under inferred authorization rather than explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
Determine which development method to use. **Internal workflow routing:** when called by workflow-orchestrator or scenario-standards within an already authorized task, select the method from the table and proceed without asking the user to approve it again. Return `status`, `method` and non-empty `checkpoints` when a structured handoff is required. Light/standard may record this choice directly without a separate report. Load only the selected method's relevant guidance. This internal mode also applies to

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
Analyze the task context and recommend a method. | Task Context | Recommended Method | Reason | | ----------------------------------------------------------------------------------------------------- | ------------------------- | ---------------------------------------------------------------- | | Business logic with clear inputs/outputs; user mentions "test first", "TDD", "测试先行" | **TDD** | TDD excels at driving implementation from precise specifications | | User story / acceptance criteria unclear; involves user behavior; mentions "BDD", "行为驱动" | **BDD** | BDD aligns implementation with user-facing behavior |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file explicitly inherits an "English Only" rule, which constrains user interaction language without user opt-in. In an agent skill, this can degrade accessibility, override user preferences, and cause the agent to ignore or mishandle security-relevant requirements provided in other languages.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill mandates an English-only policy as part of its required operating contract, which can override user language preference and exclude non-English users without necessity for the coding task itself. In an agent skill, this is dangerous because it constrains assistant behavior in a way unrelated to safety or correctness and can degrade accessibility, usability, and policy compliance.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/bdd.md (reported line 56)May include surrounding context.
md
> **Common discipline rules** (English Only, No Assumptions, Clarify First, Do EXACTLY, Research First, No Over-Engineering, Comments Explain WHY, Evidence Required) are inherited from [common-discipline.md](common-discipline.md). Violating any of them = method failure. | # | Rule | NEVER Do This | | --- | ---------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | | 1 | **Behavior, Not Implementation** — Scenarios MUST describe user-visible behavior, NOT code structure | Writing "Given the function is called" instead of "Given the user submits a valid form" | | 2 | **Scenario Outline First** — MUST write scenario outline before ANY step definitions | Writing step defs before scenarios exist |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The final workflow requires an English-only audit, reinforcing the same hard language restriction later in execution and making the limitation systematic rather than incidental. This increases the chance that the agent will ignore user language needs across the full task lifecycle, causing avoidable exclusion and instruction conflict.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/common-discipline.md (reported line 9)May include surrounding context.
md
## Common Rules (Inherited by All Methods) | # | Rule | NEVER Do This | | --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | | 1 | **English Only** — All comments, docstrings, commit messages, test names, scenario names, step definitions, API contracts, field names, and error codes MUST be in English | Writing Chinese comments, even "temporarily" | | 2 | **No Assumptions** — If ANY requirement or behavior is unclear, you MUST ask. Do NOT guess | Guessing parameter types, return types, field names, expected behavior, or acceptance criteria not explicitly stated |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/common-discipline.md (reported line 9)May include surrounding context.
md
## Common Rules (Inherited by All Methods) | # | Rule | NEVER Do This | | --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | | 1 | **English Only** — All comments, docstrings, commit messages, test names, scenario names, step definitions, API contracts, field names, and error codes MUST be in English | Writing Chinese comments, even "temporarily" | | 2 | **No Assumptions** — If ANY requirement or behavior is unclear, you MUST ask. Do NOT guess | Guessing parameter types, return types, field names, expected behavior, or acceptance criteria not explicitly stated |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/tdd.md (reported line 84)May include surrounding context.
md
## Common Rules (Inherited by All Methods) | # | Rule | NEVER Do This | | --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | | 1 | **English Only** — All comments, docstrings, commit messages, test names, scenario names, step definitions, API contracts, field names, and error codes MUST be in English | Writing Chinese comments, even "temporarily" | | 2 | **No Assumptions** — If ANY requirement or behavior is unclear, you MUST ask. Do NOT guess | Guessing parameter types, return types, field names, expected behavior, or acceptance criteria not explicitly stated |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/common-discipline.md (reported line 11)May include surrounding context.
md
| # | Rule | NEVER Do This | | --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | | 1 | **English Only** — All comments, docstrings, commit messages, test names, scenario names, step definitions, API contracts, field names, and error codes MUST be in English | Writing Chinese comments, even "temporarily" | | 2 | **No Assumptions** — If ANY requirement or behavior is unclear, you MUST ask. Do NOT guess | Guessing parameter types, return types, field names, expected behavior, or acceptance criteria not explicitly stated | | 3 | **Clarify First (Max 5 Rounds)** — Clarify all ambiguities BEFORE research/design. Count and show rounds. Each question MUST include the LLM's own recommendation. | Asking more than 5 rounds; proceeding with unresolved ambiguities; asking open questions without recommendations | | 4 | **Do EXACTLY What Is Asked** — Do NOT add anything the user did NOT explicitly request | Adding logging, metrics, fallback, retries, config, CLI flags, README, endpoints, or fields unless asked |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file imposes a blanket English-only requirement across comments, tests, contracts, and error codes without any user opt-in or justification. In an agent skill, this can improperly override user or project language requirements, reduce accessibility for multilingual teams, and cause the agent to refuse valid work based on language rather than security or correctness.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api-first.md (reported line 29)May include surrounding context.
md
| 3 | **Clarify First (Max 5 Rounds)** — Clarify all ambiguities BEFORE research/design. Count and show rounds. Each question MUST include the LLM's own recommendation. | Asking more than 5 rounds; proceeding with unresolved ambiguities; asking open questions without recommendations | | 4 | **Do EXACTLY What Is Asked** — Do NOT add anything the user did NOT explicitly request | Adding logging, metrics, fallback, retries, config, CLI flags, README, endpoints, or fields unless asked | | 5 | **Research First** — MUST research existing code and libraries before designing. If research shows existing solution is insufficient, ONLY THEN consider new tech. | Designing without knowing what already exists; writing scenarios/tests for behavior that already exists; introducing new tech without research | | 6 | **No Over-Engineering** — Solve ONLY the stated problem | Creating abstractions, utils, or frameworks not yet needed; adding pagination, filtering, sorting "because it's standard" | | 7 | **Comments Explain WHY, Not WHAT** — Package-level and block-level comments must state the design intent or decision rationale. Never write comments that merely restate what the code already says. | `# sort the list` (what), `# use TimSort; unstable sort is acceptable here because order of equal elements does not affect output` (why) | | 8 | **Evidence Required** — MUST show test/scenario/contract/validation output at each checkpoint. "It works" without output is NOT acceptable. | Claiming "tests pass" or "contract is valid" without showing output |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/common-discipline.md (reported line 16)May include surrounding context.
md
| 3 | **Clarify First (Max 5 Rounds)** — Clarify all ambiguities BEFORE research/design. Count and show rounds. Each question MUST include the LLM's own recommendation. | Asking more than 5 rounds; proceeding with unresolved ambiguities; asking open questions without recommendations | | 4 | **Do EXACTLY What Is Asked** — Do NOT add anything the user did NOT explicitly request | Adding logging, metrics, fallback, retries, config, CLI flags, README, endpoints, or fields unless asked | | 5 | **Research First** — MUST research existing code and libraries before designing. If research shows existing solution is insufficient, ONLY THEN consider new tech. | Designing without knowing what already exists; writing scenarios/tests for behavior that already exists; introducing new tech without research | | 6 | **No Over-Engineering** — Solve ONLY the stated problem | Creating abstractions, utils, or frameworks not yet needed; adding pagination, filtering, sorting "because it's standard" | | 7 | **Comments Explain WHY, Not WHAT** — Package-level and block-level comments must state the design intent or decision rationale. Never write comments that merely restate what the code already says. | `# sort the list` (what), `# use TimSort; unstable sort is acceptable here because order of equal elements does not affect output` (why) | | 8 | **Evidence Required** — MUST show test/scenario/contract/validation output at each checkpoint. "It works" without output is NOT acceptable. | Claiming "tests pass" or "contract is valid" without showing output |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly inherits an 'English Only' rule without any user opt-in or documented operational necessity. This creates an unjustified policy constraint that can exclude users, distort user intent, and cause the agent to refuse or mishandle legitimate requests in other languages.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/direct-implementation.md (reported line 48)May include surrounding context.
md
> **Common discipline rules** (English Only, No Assumptions, Clarify First, Do EXACTLY, Research First, No Over-Engineering, Comments Explain WHY, Evidence Required) are inherited from [common-discipline.md](common-discipline.md). Violating any of them = method failure. | # | Rule | NEVER Do This | | --- | ------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | | 1 | **Confirm Scope First** — establish qualification from task and repository evidence; internal workflow routing inherits existing authorization | Assuming a task is trivial without checking | | 2 | **Check Existing Code** — MUST search for existing similar code before writing new code | Writing a new function when one already exists in the codebase |

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document gives conflicting secret-handling guidance: the contract prohibits storing secrets in environment variables, while the anti-pattern remediation later recommends using environment variables for secrets. In a security-focused skill, contradictory instructions can cause developers or agents to choose weaker secret management practices inconsistently, leading to accidental exposure or insecure deployment patterns.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
> I will NOT use MD5, SHA1, or plain text for passwords or tokens. > I will NOT log sensitive data (passwords, tokens, PII) under any circumstances. > I will NOT do work the user did not ask for. > I will NOT introduce new dependencies without checking them for known vulnerabilities (CVE scan). > I inherit all common discipline rules from [common-discipline.md](common-discipline.md). **These are not suggestions. They are the method.** Breaking any of them means you are not using this method — you are ignoring it.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/direct-implementation.md (reported line 50)May include surrounding context.
md
> I will NOT use MD5, SHA1, or plain text for passwords or tokens. > I will NOT log sensitive data (passwords, tokens, PII) under any circumstances. > I will NOT do work the user did not ask for. > I will NOT introduce new dependencies without checking them for known vulnerabilities (CVE scan). > I inherit all common discipline rules from [common-discipline.md](common-discipline.md). **These are not suggestions. They are the method.** Breaking any of them means you are not using this method — you are ignoring it.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/security-first.md (reported line 19)May include surrounding context.
md
> I will NOT use MD5, SHA1, or plain text for passwords or tokens. > I will NOT log sensitive data (passwords, tokens, PII) under any circumstances. > I will NOT do work the user did not ask for. > I will NOT introduce new dependencies without checking them for known vulnerabilities (CVE scan). > I inherit all common discipline rules from [common-discipline.md](common-discipline.md). **These are not suggestions. They are the method.** Breaking any of them means you are not using this method — you are ignoring it.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The inherited common discipline rules explicitly include "English Only," which imposes a fixed language requirement. This is a natural-language policy violation because the file does not offer the user a language choice, opt-in, or a clear region/compliance justification for restricting language.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/security-first.md (reported line 30)May include surrounding context.
md
> **Common discipline rules** (English Only, No Assumptions, Clarify First, Do EXACTLY, Research First, No Over-Engineering, Comments Explain WHY, Evidence Required) are inherited from [common-discipline.md](common-discipline.md). Violating any of them = method failure. | # | Rule | NEVER Do This | | --- | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ | | 1 | **No Secrets in Code** — No passwords, API keys, or tokens in source code | Committing `.env` files, hardcoding `API_KEY = "sk-..."` | | 2 | **Input Validation** — ALL external input MUST be validated and sanitized before use | Trusting `request.body` without validation; SQL concatenation |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly inherits an 'English Only' rule, which constrains user interaction language without opt-in or a task-specific safety justification. In an agent skill, this can degrade accessibility, cause user intent to be misunderstood, and create brittle behavior when non-English inputs are provided.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/tdd.md (reported line 84)May include surrounding context.
md
> **Common discipline rules** (English Only, No Assumptions, Clarify First, Do EXACTLY, Research First, No Over-Engineering, Comments Explain WHY, Evidence Required) are inherited from [common-discipline.md](common-discipline.md). Violating any of them = method failure. | # | Rule | NEVER Do This | | --- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | | 1 | **No Fallback Unless Requested** — Do NOT add fallback values or graceful degradation unless the user explicitly asks | `return None`, `return 0`, `return []`, try/except pass, default params — unless user asked | | 2 | **Cautious Tech Introduction** — Do NOT introduce new libraries, frameworks, or tools unless there is NO acceptable existing solution. Must present pros/cons for user approval. | Introducing new tech "just in case"; adding a dependency without comparing it to existing solutions; recommending new tech without user approval |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/tdd.md (reported line 88)May include surrounding context.
md
| --- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | | 1 | **No Fallback Unless Requested** — Do NOT add fallback values or graceful degradation unless the user explicitly asks | `return None`, `return 0`, `return []`, try/except pass, default params — unless user asked | | 2 | **Cautious Tech Introduction** — Do NOT introduce new libraries, frameworks, or tools unless there is NO acceptable existing solution. Must present pros/cons for user approval. | Introducing new tech "just in case"; adding a dependency without comparing it to existing solutions; recommending new tech without user approval | | 3 | **Design Doc First** — MUST write design doc before ANY code | Writing code before design doc exists and is shown to user | | 4 | **One Test Case at a Time** — New code: write ONE new failing test, make it pass, THEN write the next. Existing code: modify existing tests to incorporate the change, then add ONE new test case at a time. | Writing multiple new tests before implementing any; creating unnecessary new tests when existing tests suffice | | 5 | **Minimum Implementation** — Write ONLY enough code to make the current test pass | Adding features not required by the current test | | 6 | **Refactor Separately** — Only refactor AFTER all tests pass, o ...[truncated 25 chars]

Static analysis

No suspicious patterns detected.