Security audit

code-spec-guardian

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate code-style analysis purpose, but it also tries to persist its own future use by default through AGENTS.md.

Install only if you are comfortable with the skill creating and updating `.code-spec/` files and potentially changing future assistant behavior through `AGENTS.md`. Before use, require an explicit diff and approval for any `AGENTS.md` change, review generated spec files before committing them, and avoid allowing raw `.env` or credential-bearing files to be read unless you have confirmed values will stay redacted.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill explicitly directs the agent to create and update project files such as `.code-spec/*`, `.code-spec/_meta.json`, and `AGENTS.md`, yet no declared permissions are present. This creates a capability transparency problem: users and the platform may not realize the skill can persistently modify repository state, increasing the chance of unauthorized or surprising writes.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill instructs persistent modification of `AGENTS.md` so that future sessions will automatically invoke the same skill. This is a self-persistence mechanism that changes future agent behavior and can create lasting authority amplification well beyond the user's immediate request.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Default insertion of a trigger into `AGENTS.md` is not necessary for a code-spec analysis task and extends the skill's control into future sessions. Because `AGENTS.md` influences agent behavior globally for the project, this creates an unjustified persistence channel and raises the risk of prompt-level privilege creep.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The README advertises very broad natural-language triggers such as writing code, fixing bugs, refactoring, code review, and generic 'help me write XX' requests. In an agent environment, this can cause the skill to activate during ordinary development conversations without clear user intent, unexpectedly influencing outputs or initiating further actions tied to the skill.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README states that the AI will automatically generate a `.code-spec/` directory and that users can 'reset specs' to clear and re-analyze, but it does not present a strong upfront warning that the skill may modify files in the project workspace. In agentic contexts, undocumented write/reset behavior can lead to unintended filesystem changes, overwriting curated specs, or destructive resets triggered by casual user phrasing.

Vague Triggers

High

Confidence: 89% confidence
Finding: The trigger phrases are extremely broad and overlap with ordinary coding requests such as writing code, fixing bugs, refactoring, or asking how to change something. This increases the chance of unintended invocation, causing the skill to run and potentially write files or alter workflow in situations where the user did not intend to activate it.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The routing table uses ambiguous terms like API, SQL, architecture, refactor, and new code requests without constraints or confirmation gates. In combination with file-writing behavior, these high-collision triggers can cause excessive or mistaken module loading and unexpected side effects.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill directs automatic creation or modification of `AGENTS.md` without upfront warning that a persistent project file will be changed. Silent modification of durable configuration/policy files is dangerous because it can alter future agent behavior in ways the user did not knowingly authorize.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The first-run flow writes multiple files under `.code-spec/`, updates metadata, and may create indexes, but the user warning only mentions that analysis will take time. Omitting a clear notice about repository writes undermines informed consent and can lead to unexpected persistent changes in the project.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The instruction explicitly tells the agent to write `.code-spec/architecture.md` but does not require user confirmation or even warn that project files will be modified. In an agent skill that auto-applies when `.code-spec/` exists and is used during analysis/code-generation workflows, silent writes can cause unintended repository changes, overwrite curated specs, or be abused to persist misleading project guidance.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs reading `.env` and environment-specific files without a privacy boundary, only saying not to extract values. That is still risky because `.env` files routinely contain secrets, and an agent may over-read, log, summarize, or expose sensitive values in prompts, traces, or generated outputs despite the intent to list names only.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The skill explicitly instructs the agent to write `.code-spec/git-spec.md`, which is a project file modification, but provides no requirement to obtain user confirmation or warn that repository contents will be changed. In an auto-triggered code-spec guardian context, this increases the chance of unintended writes to the user's workspace, potentially altering tracked files or influencing later code-generation behavior without clear consent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The instruction explicitly tells the agent to append to `.code-spec/node-style.md`, which is a repository-modifying action, but it provides no requirement to obtain user confirmation or even disclose that a file write will occur. In an agent skill that is triggered during analysis/spec review, silent persistence can unexpectedly alter project state, create commit noise, or let derived content be stored in the repo without the user's informed consent.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The instruction explicitly tells the agent to append to `.code-spec/php-style.md`, which causes a repository modification without any user-facing disclosure or confirmation step. In a code-analysis skill, silent writes are risky because users may expect read-only analysis, and the skill could persist unwanted or misleading content into the repo state.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The document explicitly instructs the agent to append content into `.code-spec/rust-style.md` without requiring user confirmation, disclosure, or a safe review step. In a skill that auto-applies project conventions and influences code generation, silent file modification can create unintended persistent changes and could be abused to poison future outputs or alter repository state without clear consent.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The skill explicitly instructs the agent to write `.code-spec/sql-spec.md` in the repository without any requirement for user confirmation, dry-run behavior, or warning that local files will be modified. In an auto-triggered code-spec guardian context, this increases the chance of unintended repository mutation and can lead to silent, unauthorized changes to tracked files or generated policy artifacts.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The document explicitly instructs the agent to write to `.code-spec/ui-style.md` but does not mention obtaining user consent, previewing the generated content, or disclosing that a project file will be modified. In a skill that auto-activates when `.code-spec/` exists and constrains future code generation, silent writes can unexpectedly alter project behavior and persist agent-derived instructions.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger conditions are broad enough that ordinary conversational input can be interpreted as a signal to evolve project rules, which may cause the skill to activate or persist preferences without clear user intent. In a code-generation and code-review skill, this can poison future outputs by silently changing governing specs based on incidental dialogue rather than explicit configuration.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The 'implicit preference' rule is especially vague because it allows multi-turn conversational patterns to be converted into persistent project standards without a precise threshold or scope boundary. This creates a prompt-injection-style persistence risk where transient or attacker-influenced phrasing can become lasting repository guidance and affect later code generation or review behavior.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The file describes automatic writes and updates to spec artifacts but does not require a clear warning that user conversation may modify repository files. In this skill, silent persistence is more dangerous because the written specs directly influence future code generation across multiple languages and frameworks, enabling durable manipulation of development behavior.

Ssd 4

Medium

Confidence: 95% confidence
Finding: Persisting a self-reinforcing trigger into `AGENTS.md` without explicit confirmation creates a durable mechanism for future automatic invocation. In skill context, this is more dangerous because the skill's triggers are already broad, so persistence compounds accidental activation and gradually elevates the skill's practical authority over future coding tasks.

Static analysis

No suspicious patterns detected.