Security audit

cc-godmode

Security checks for vulnerabilities and agentic risk

Overview

This docs-only development orchestrator is mostly transparent, but it can direct agents into high-impact GitHub and release actions without clear confirmation gates.

Install this only if you want an agent to coordinate real development work across local files, tests, web research, browser automation, and GitHub. Before using release or issue workflows, keep GitHub tokens narrowly scoped and require manual confirmation for PR merges, branch deletion, issue closure, release creation, and any unattended cron-triggered run.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The README states the skill is 'documentation-only' and claims there are no external API calls or file modifications, but the same document describes agent behaviors that perform web research, GitHub operations, E2E testing, and code/documentation changes through tool calls. This mismatch can mislead users and downstream reviewers into underestimating the skill's operational reach, increasing the chance that powerful actions are enabled without appropriate scrutiny or safeguards.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill describes itself as a self-orchestrating development workflow that decides how to act, with broad tooling including Bash, Write, WebFetch, WebSearch, and GitHub operations. Because the top-level description is highly generic and lacks explicit activation boundaries, it could be invoked for many ordinary development prompts and then perform powerful actions in contexts the user did not intend, increasing the chance of overbroad execution.

Vague Triggers

Low

Confidence: 84% confidence
Finding: The quick-start commands are framed as examples, but they effectively advertise a broad command surface without stating what should not trigger the skill. In a skill that can delegate to agents with code execution, network, browser automation, and GitHub capabilities, ambiguous trigger scope can cause accidental activation on generic requests and unintended workflow execution.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The manifest description, "Self-orchestrating multi-agent development workflows. You say WHAT, the AI decides HOW," is broad and lacks explicit activation boundaries or safety constraints. In the context of a skill that documents workflows using shell, network, file, and credentialed operations at runtime, this can encourage invocation for open-ended tasks where the agent autonomously chooses potentially risky actions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The GitHub manager section includes commands such as `gh pr merge [number] --squash --delete-branch` and `gh release create` that can mutate repository state, publish releases, or remove branches, but it provides no requirement for explicit user approval, dry-run review, or branch/repo scope validation before execution. In a self-orchestrating agent skill, these instructions increase the risk that an autonomous agent performs unintended or irreversible repository operations based only on inferred intent.

Static analysis

No suspicious patterns detected.