T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:10- Finding
Excessive Cross-Session and Cross-Project Information Access
- Content
View full analysis
- Remediation
View remediation
Security audit
Plan
Security checks for vulnerabilities and agentic risk
Overview
This planning skill is mostly coherent, but it can search past chats and other projects by default and may write those findings into repo planning files.
Install only if you are comfortable with the skill searching prior agent sessions and other projects when making plans. Prefer using it in environments where those MCP tools are disabled or explicitly scoped, and review generated docs/plan files before committing because they may contain information derived from outside the current repository.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is presented as an exploratory planning tool, but it is explicitly authorized to create directories and write
spec.mdandplan.mdinto the repository. That mismatch can cause unintended repository modification in workflows that expect read-only analysis, making it easier to smuggle state-changing behavior behind a planning label.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger conditions are broad enough to match common requests such as 'write a spec' or general feature descriptions, which increases the chance the skill activates in situations where the user did not intend repository writes or extensive codebase scanning. Over-broad invocation criteria are dangerous because they widen the blast radius of a privileged skill.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill repeatedly claims 'Zero questions' and 'Zero interactive questions,' yet later instructs the agent to ask for missing input and approval. This inconsistency can mislead users and orchestration systems about when interaction will occur, undermining trust and potentially bypassing expectations for explicit consent before writes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The outward-facing output focuses on research and next steps but omits a prominent warning that the skill creates directories and writes planning files into the repository. Hiding side effects behind incomplete documentation weakens informed consent and can lead to unauthorized or surprising modifications in automated environments.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The instructions tell the agent to detect deployment infrastructure and include concrete deployment commands and a deploy phase in the generated plan. While still indirect, this introduces production deployment capability into a skill whose stated purpose is codebase exploration and implementation planning, not release or operations workflow design. That capability is not clearly justified by the narrow manifest wording.
- Content
Static analysis
No suspicious patterns detected.