cross-ref

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:50 PM UTC
• Version: 1.1.2

Overview

This skill has a coherent GitHub cross-reference purpose, but its automation needs review because repo-controlled text and some local state can influence agent prompts or shell arithmetic.

Use this only with repositories you are comfortable processing through the configured agent runtime. Prefer a read-only GitHub token for analysis, inspect generated reports and exact comment bodies carefully, and do not run the posting script until the shell validation issues are fixed or you fully trust the workspace and invocation parameters.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:106

Finding

Untrusted Repository Content Is Directly Embedded in Agent Prompts

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fetch-data.sh:13

Finding

Unvalidated PR Count Is Evaluated as a Bash Arithmetic Expression

Content

View full analysis

&2 exit 1 fi mkdir -p "$WORKSPACE/batches" echo "=== Cross-Ref Data Fetch ===" echo "Repo: $REPO" echo "Workspace: $WORKSPACE" echo "PRs: $PR_COUNT ($PR_STATE)" echo "Issues: $ISSUE_COUNT ($ISSUE_STATE)" echo "" # ─── Fetch PRs ─────────────────────────────────────────────────────────── echo "Fetching PRs..." PR_FILE="$WORKSPACE/prs.json" echo "[" > "$PR_FILE" FETCHED=0 PAGE=1 FIRST=true while [ "$FETCHED" -lt "$PR_COUNT" ]; do REMAINING=$((PR_COUNT - FETCHED)) ``` ### Technical Analysis The third command-line argument is accepted as `PR_COUNT` without validating that it is a bounded decimal integer. It is subsequently consumed by numeric comparison and Bash arithmetic evaluation. Bash arithmetic contexts recursively interpret variable values as arithmetic expressions. Crafted input can therefore be interpreted as more than a number. Dangerous arithmetic forms, including expressions involving array subscripts and command substitutions, can result in command execution in vulnerable evaluation paths. The repository identifier is validated, but the numeric count parameters and state parameters are not. Quoting the variable in the `test` expression does not convert attacker-controlled arithmetic syntax into a safe integer. `ISSUE_COUNT` should also be validated even though the most direct Bash arithmetic sink shown here is `PR_COUNT`; it is later supplied to Python integer conversion and controls API-loop behavior. ### Attack Path 1. An attacker or untrusted a ...[truncated 1235 chars]

Remediation

View remediation

&2 exit 1 fi if (( 10#$value > maximum )); then echo "Error: $name must not exceed $maximum" >&2 exit 1 fi } validate_count "pr_count" "$PR_COUNT" 10000 validate_count "issue_count" "$ISSUE_COUNT" 10000 ``` 3. Normalize the values after validation using base-10 conversion. 4. Allowlist states before placing them in API query strings: ```bash case "$PR_STATE" in open|closed|all) ;; *) echo "Error: invalid pr_state" >&2; exit 1 ;; esac case "$ISSUE_STATE" in open|closed|all) ;; *) echo "Error: invalid issue_state" >&2; exit 1 ;; esac ``` 5. Add negative tests containing arithmetic operators, whitespace, signs, array syntax, command-substitution syntax, excessively large values, and non-decimal representations. 6. Ensure the orchestrating agent validates invocation parameters independently before launching the script. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/post-comments.sh:49

Finding

Attacker-Controlled Progress State Is Re-Evaluated in Bash Arithmetic Contexts

Content

View full analysis

"$tmp" mv "$tmp" "$PROGRESS_FILE" } cleanup() { rm -f "$BODY_FILE" } trap cleanup EXIT for ((i=START_INDEX; i

Remediation

View remediation

= 0) and (.day_count | type == "number" and floor == . and . >= 0) and (.day_start_utc | type == "string") ' "$PROGRESS_FILE" >/dev/null; then echo "Error: invalid progress file" >&2 exit 1 fi ``` 3. After extraction, apply an independent shell decimal check: ```bash [[ "$START_INDEX" =~ ^[0-9]+$ ]] || exit 1 [[ "$DAY_COUNT" =~ ^[0-9]+$ ]] || exit 1 ``` 4. Reject inconsistent bounds: - `START_INDEX` must not exceed `TOTAL`. - `DAY_COUNT` must not exceed the configured daily maximum. - `TOTAL`, completed count, and remaining count must be mutually consistent. 5. Store state in a workspace directory that is owned by the current user and not writable by other users. 6. Create files with restrictive permissions, such as `umask 077`, and continue using atomic temporary-file replacement. 7. Bind progress state to the repository and approved queue, for example by recording the repository identifier and a cryptographic hash of `approved-comments.json`. Refuse to resume if either differs. 8. Add tests for JSON strings, negative values, fractions, huge numbers, arithmetic operators, corrupted files, `completed > TOTAL`, and progress copied from another queue. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The principles file instructs the agent to close the non-canonical PR, which conflicts with the skill metadata stating that comments are optional, report-first, and that labels and closes are never automated. In an agent setting, contradictory instructions can cause unsafe state-changing behavior if downstream logic or operators follow the more specific workflow text instead of the higher-level safety constraints.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test-helpers.sh (reported line 16)May include surrounding context.

sh

bash -n "$SCRIPT_DIR/post-comments.sh" && pass "post-comments.sh syntax"
bash -n "$SCRIPT_DIR/fetch-data.sh" && pass "fetch-data.sh syntax"

if "$SCRIPT_DIR/post-comments.sh" ../etc/passwd "$TMP_DIR" >/dev/null 2>&1; then
  fail "reject path traversal repo"
else
  pass "reject path traversal repo"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

md

- **Evidence over narrative** — Never classify duplicates from title similarity alone
- **Confidence requires specifics** — If you can't explain the shared root cause in one sentence, it's not "high"
- **Credit preservation** — Never frame a duplicate as wasted work
- **Conservative defaults** — Better to miss a link than create a false one
- **Reversibility** — Every comment includes a correction path

## Safe posting

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill performs network access, file writes, and potentially uses environment-backed credentials, but it does not declare a restrictive tool scope such as allowed tools or explicit permissions. That mismatch increases the blast radius if the skill is invoked in a broader-than-expected runtime, because execution capabilities are available without machine-readable constraints.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest frames the skill as read-only and report-first, but the body includes an operational phase that can post comments to GitHub. This creates a trust-boundary mismatch: operators or upstream policy engines may approve the skill expecting analysis-only behavior, while the implementation contains a write path that could be activated later.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest frames the skill as a specific cross-reference analyzer for a named repository or supplied PR/issue set. The implementation instructs spawning multiple general-purpose Task subagents with large prompt payloads and repository data, which is a broader orchestration capability than the manifest directly declares, even if used here for analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script fetches PR and issue metadata from the GitHub API and writes multiple JSON and text index files into the provided workspace directory. While the usage header says output goes to the workspace, it does not clearly warn that potentially sensitive repository text and usernames are persisted locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.