Agent Conductor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:27 AM UTC
• Version: 1.0.1

Overview

This skill is not clearly malicious, but it broadly instructs agents to delegate ordinary code changes and command execution to external coding agents with weak scoping and unsafe shell-command examples.

Install only if you deliberately want a workflow that launches other local coding agents for implementation work. Before use, constrain allowed paths and commands, avoid passing secrets or auth material in delegated prompts, prefer shell-free argument passing or stdin/task files, and manually review any background or long-running agent jobs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:16

Finding

Shell Command Injection Through Unescaped Task Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–21 and 60–62
Vulnerability Type: Shell command injection
Risk Level: Medium

Vulnerable Code

markdown

| Agent | Invoke Command |
|-------|---------------|
| Claude Code | `claude '<task>'` |
| OpenAI Codex | `codex '<task>'` |
| Cursor Agent | `cursor-agent '<task>'` |
| Gemini Code | `gemini-code '<task>'` |
| Any other | `your-agent-cmd '<task>'` |

markdown

| Duration | Mechanism |
|----------|-----------|
| < 5 min | Foreground: `exec pty:true command:"AGENT_CMD '...'"` |
| 5–30 min | Background: `exec pty:true background:true timeout:1800 command:"AGENT_CMD '...'"` |

Technical Analysis

The documented execution pattern places task content directly inside a shell command delimited by single quotes. It does not require shell-safe escaping, an argument-array API, input validation, or transport through standard input.

If the execution tool passes the resulting command string to a shell, a task containing a single quote can terminate the intended argument. Additional shell operators and commands can then be interpreted as executable syntax rather than task data.

For example, interpolating a task shaped like the following into the documented pattern would break the quoting boundary:

text

' ; attacker-command ; #

The resulting command would be structurally equivalent to:

sh

AGENT_CMD '' ; attacker-command ; #'

Whether exploitation succeeds depends on the surrounding execution API using shell interpretation and on attacker influence over the interpolated task text. The unsafe pattern nevertheless creates a command-injection boundary.

Attack Path

1. An attacker influences task text supplied to the orchestration workflow, such as through a repository issue, document, dataset entry, or other untrusted task source.
2. The task contains a single quote followed by shell control operators and an attacker-selected command.
3. The orchestrator substitu ...[truncated 1054 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not concatenate task text into a shell command string.

2. Prefer an execution API that accepts the executable and arguments as an array and does not invoke a shell, for example conceptually:

   text

   executable: AGENT_CMD
   arguments: [task]
   shell: false
   

3. For lengthy or untrusted tasks, write the task to a securely created temporary file and pass only that file path to the agent.

4. Alternatively, pass task content through standard input when supported by the selected CLI agent.

5. If shell execution is unavoidable, use a well-tested, platform-specific argument-escaping routine rather than manual quote wrapping.

6. Validate task inputs and reject control characters or shell metacharacters where they are not legitimately required.

7. Update all invoke-command examples and foreground/background execution templates to demonstrate shell-free execution.

8. Run delegated agents with least privilege, restricted filesystem access, minimal environment variables, and constrained network access to reduce the impact of any future injection flaw.

9. Add acceptance tests containing single quotes, command substitutions, semicolons, newlines, and shell operators to confirm that task content is passed strictly as data.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says to use the skill whenever writing or modifying code files, running scripts or data pipelines, batch processing datasets, or multi-stage workflows. This is a very expansive trigger scope for a manifest/markdown file and does not provide concrete exclusion examples beyond a few broad negatives, increasing the chance of unintended invocation for ordinary development work.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The rule 'If it produces file changes → dispatch it' is overly broad and pushes almost any write-capable task to a sub-agent, increasing the chance that routine or sensitive changes are executed indirectly without sufficient review. In this skill context, that matters because the skill is specifically intended to launch external coding agents and scripts, so ambiguous dispatch criteria can expand execution scope and reduce human scrutiny over risky operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.