Validate

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:32 PM UTC
• Version: 2.1.1

Overview

This skill has a coherent startup-validation purpose, but it asks for broader local and shell access than its workflow clearly needs and writes a PRD file without explicit save confirmation.

Before installing, treat this as a Review item: use it only in a project where searching local Markdown notes is acceptable, confirm where the PRD will be saved, and consider removing Bash or running it in a scoped workspace if your knowledge base contains private material.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:10

Finding

Excessive Shell Permission and Overly Broad Local Search Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:10, 36-37
Vulnerability Type: Excessive permissions and insufficiently scoped local data access
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: Read, Grep, Bash, Glob, Write, Edit, AskUserQuestion, WebSearch, mcp__solograph__kb_search, mcp__solograph__project_info, mcp__solograph__web_search

markdown

Otherwise search locally:
- Grep for idea keywords in `.md` files across the project and knowledge base

Technical Analysis

The skill requests unrestricted Bash access even though its documented validation workflow does not identify any operation that requires arbitrary shell-command execution. This violates the principle of least privilege: compromise or misuse of the skill's instructions would have access to a substantially more powerful execution channel than the legitimate task requires.

The local fallback search is also insufficiently bounded. It directs the agent to search Markdown files “across the project and knowledge base” without specifying approved directories, exclusions, maximum traversal depth, or handling rules for sensitive results. Depending on the host environment, this scope could include unrelated private notes, internal documentation, persistent agent state, or conversation-derived files.

No instruction was found that explicitly transmits local file contents to an external party. Therefore, the issue establishes unnecessary access and disclosure risk, not confirmed exfiltration or malicious intent.

Attack Path

1. The skill is invoked with Bash, Read, Grep, and Glob permissions.
2. The fallback workflow searches unspecified Markdown files throughout the project and knowledge base.
3. An unrelated sensitive document or a document containing adversarial prompt instructions matches the idea keywords.
4. The matched content enters the agent's context.
5. Sensitive content may be reproduced in va ...[truncated 1173 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash from allowed-tools because no documented workflow step requires arbitrary command execution.
2. Retain only the minimum necessary tools, such as Read, narrowly scoped Grep or Glob, Write for the designated PRD, user prompting, and approved search integrations.
3. Restrict fallback searches to explicit approved paths, such as docs/research/ and a user-selected knowledge-base directory.
4. Define exclusions for hidden directories, credentials, memory or state stores, conversation logs, configuration files, generated outputs, and unrelated project directories.
5. Require explicit user approval before searching outside the current project's designated research directory.
6. Constrain write operations to docs/prd.md or a user-approved destination rather than granting general project modification capability.
7. Treat all retrieved local and remote documents as untrusted data. Explicitly instruct the agent not to follow commands embedded in search results.
8. Apply host-level sandboxing and filesystem allowlists so skill metadata alone cannot grant access beyond the task-specific workspace.
9. Add limits for search depth, file count, file size, and result volume to reduce unintended collection.
10. Redact sensitive values before incorporating retrieved material into generated reports.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs writing a PRD to docs/prd.md in the current project directory, but it does not require a clear user-facing warning or confirmation immediately before modifying the workspace. In an agent setting, this can cause unexpected file creation or overwriting, especially if the user intended only analysis or validation rather than persistent changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.