T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/create-ddd-project.sh:342- Finding
Remote Maven Archetype Retrieved from an Unverified Private Repository
- Content
View full analysis
- Remediation
View remediation
Security audit
xfg-ddd-skills
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for DDD project generation and deployment help, but its deployment and scaffolding guidance carries review-worthy supply-chain and unsafe-default risks.
Review this skill before installing if you may use it for real deployments. Treat its generated projects, Maven archetype source, Docker images, Compose files, SQL scripts, and credentials as untrusted templates until you verify provenance, replace secrets, bind services safely, avoid destructive SQL on existing data, and confirm the target environment.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:1283- Finding
Privately Mirrored Container Images Are Used Without Digest or Signature Verification
- Content
View full analysis
- Remediation
View remediation
``` 3. Verify image signatures and attestations with a policy-enforcement mechanism such as Cosign and admission policies. 4. Maintain and review an SBOM for every image. 5. Scan mirrored images for known vulnerabilities and unexpected files before making them available. 6. Ensure mirroring preserves upstream digests and reject any digest mismatch. 7. Protect registry publishing accounts with least privilege, short-lived credentials, and multi-factor authentication. 8. Separate development acceleration mirrors from approved production image sources. 9. Run containers as non-root where supported, use read-only filesystems, drop Linux capabilities, and restrict egress to reduce supply-chain compromise impact. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
references/devops-deployment.md:39- Finding
Deployment Templates Expose Services with Predictable Credentials
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/devops-deployment.md:300- Finding
Example Deployment Seeds a Known MD5 Password and Downgrades MySQL Authentication
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (45)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes broad everyday terms such as deployment/build/operations words that can unintentionally activate a skill containing actionable shell, Docker, and database instructions. In an agent setting, accidental invocation can lead to high-risk operational guidance being surfaced or followed in contexts where the user did not explicitly intend infrastructure changes.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The deployment-related triggers are especially broad and overlap with common requests around Docker, databases, restart, environment config, and production/test environments. Because the skill contains commands that start containers, initialize databases, and manipulate services, broad activation materially increases the chance of unintended operational actions or unsafe advice being applied to the wrong project or environment.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The SQL initialization example includes
DROP TABLE IF EXISTSstatements for multiple tables with no warning that it is destructive. If reused against a non-empty or production database, it can permanently erase application data before recreating schema, making this especially dangerous in a deployment skill that users may directly apply.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly encourages invocation from very broad user phrases such as creating a new project, deploying, building, starting services, or working with common infrastructure like Docker, MySQL, Redis, and RabbitMQ. This can cause the skill to activate in many generic development contexts and steer the agent into generating or executing deployment-oriented actions without sufficiently explicit user intent, increasing the chance of unsafe or unexpected operational changes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description and operational instructions are primarily written in Chinese and present invocation/usage in that language without indicating that users may choose another language. This can violate a language/locale policy when no opt-in or documented justification for a Chinese-only workflow is provided.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 91% confidence
- Finding
The trigger
deployconflicts with common built-in or ecosystem command vocabulary and may shadow safer default behaviors. In practice, that can route ordinary deployment-related user requests into this skill’s specific scripts and operational instructions, raising the risk of unintended command generation or environment manipulation.- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 92% confidence
- Finding
The bare trigger
buildis highly collision-prone with standard developer commands and assistant capabilities. That can cause this skill to intercept generic build requests and present operationally sensitive instructions, including packaging and container workflows, without sufficient precision or safety gating.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The deployment section includes commands that start/stop containers, initialize MySQL, and run services, but it lacks clear warnings about destructive impact, environment targeting, credential exposure, and service interruption. In a skill that may be invoked automatically, omission of these safeguards increases the likelihood of accidental production changes, downtime, or data loss.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The deployment guide tells users to run
docker-compose ... downon both the application and environment stacks without warning about service interruption, dependency shutdown, or persistence implications. In a DevOps skill, operators may copy-paste these commands into live environments, causing avoidable outages and possible data-access disruption even if named volumes remain.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation instructs users to replace official Docker Hub image sources with a third-party mirrored registry but provides no provenance, signature verification, digest pinning, or trust warning. In a deployment-oriented skill, this increases supply-chain risk because users may implicitly trust mirrored images that could be stale, altered, or compromised, especially when the images include infrastructure components like MySQL, Redis, Nginx, and Java runtimes.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The title and the entire guidance are written in Chinese, and the file does not indicate that this language choice is optional or limited to a specific justified audience or region. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all instructions and examples exclusively in Chinese, which can amount to a language policy violation when no user opt-in or alternative locale is offered. The document does not state that it is intended only for a Chinese-speaking audience or provide any language selection guidance.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Retrofit gateway example exposes unrestricted outbound HTTP requests to arbitrary caller-controlled URLs and headers, effectively providing a generic SSRF-capable primitive. In an agent skill context, this is dangerous because later generated code may directly operationalize these patterns for internal-network access, data exfiltration, or interaction with unintended services, and the capability is broader than the stated DDD/infrastructure guidance purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The document includes external network transmission examples but provides no warning that requests may send sensitive data to untrusted destinations or require destination validation. In a skill/template package, omission of such guidance increases the chance that unsafe examples are copied verbatim into agent-generated or developer-authored code.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The RestTemplate callback example sends JSON to arbitrary supplied URLs without allowlisting or destination validation, creating a reusable pattern for SSRF and unauthorized outbound data transmission. Because this is presented as a recommended infrastructure pattern, consumers may copy it into production systems and expose internal data or reach internal-only services.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document is written entirely in Chinese and presents the skill guidance in that language without indicating any language option or opt-in. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown document presents its title and substantive instructional content in Chinese, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document explicitly states that value objects should be immutable, but several examples use Lombok annotations such as @Data, @Builder, @NoArgsConstructor, and mutable fields, which generate setters or otherwise permit post-construction mutation. In a DDD skill, this is a real security-relevant design flaw because downstream users may copy these patterns into domain models that are assumed to be safe, causing broken invariants, race-condition-prone state changes, and authorization/business-rule bypass through unintended object mutation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script is hardcoded to use an external Maven repository and later invokes Maven archetype generation against it, causing network access and retrieval of build artifacts from a third-party source. If users are unaware of this, they may unintentionally execute unreviewed remote content or violate network policy in restricted environments.
- Content
Static analysis
No suspicious patterns detected.