dodaf-skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned DoDAF scaffolding, but it overstates its verification strength and includes automatic web research for sensitive defense work without clear user control.

Review before installing. Use this only in a dedicated, non-sensitive workspace unless you have approved external searches and output locations. Do not rely on its verification report for real DoDAF compliance or defense architecture assurance without independent expert review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code generally aligns with the documentation/report-generation portion of the description: it creates DoDAF-themed project artifacts and can assemble a consolidated report, with optional PDF/DOCX export. However, key declared capabilities are missing. There is no logic to verify models, no completeness or consistency checking, and no step-by-step guided design workflow. The generated content is largely a scaffold/template with predefined viewpoints and placeholder matrices rather than a comprehensive architecture modeling assistant. Therefore, the description overstates the actual behavior in material ways.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The declared description significantly overstates the implemented functionality. The supplied code only verifies a project directory by checking for expected file names/content markers for DoDAF views and printing a textual verification summary to stdout. It does not create architecture models, provide interactive guidance, or generate integrated PDF/Word documentation. While the verification aspect is broadly aligned, even that is narrower than claimed: the consistency checks are basic regex/content checks rather than comprehensive semantic completeness/consistency validation. Therefore, the description does not accurately represent the actual behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill describes capabilities that imply reading and writing files and invoking shell-based tooling such as pandoc and draw.io, but it does not declare an explicit tool scope or permissions boundary. That creates ambiguity about what the agent may access or execute, increasing the risk of unintended file modification, broad filesystem access, or unsafe command execution in environments that infer capabilities from content.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill says it will automatically search for defense doctrine, standards, and similar material when user input is insufficient, but it gives no user-facing warning that network access may occur or that project details could be transmitted externally. In a defense-architecture context, even seemingly routine architecture descriptions may contain sensitive mission, stakeholder, or classification-related information, making silent external lookup materially risky.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest says the skill will 'verify' DoDAF 2.0/2.1 models with 'comprehensive completeness and consistency checks' and guide users through architecture design. In this file, create_dodaf_model only generates static template content and create_project_structure makes directories; there is no logic that inspects an input model, checks completeness, evaluates consistency, or provides interactive step-by-step guidance.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The manifest describes outputting an integrated DoDAF report covering all views. However, assemble_consolidated_report merely reads a predetermined list of filenames from docs/ and appends those that exist; it does not ingest the generated DODAF_MODEL.md, does not ensure all declared viewpoints/products are represented, and performs no integration or completeness enforcement.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = ["pandoc", str(report_path), "-o", str(output_file)] + config["args"]

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
        if result.returncode == 0:
            print(f"Report converted to {output_format.upper()}: {output_file}")
            return str(output_file)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The module docstring advertises checks for cross-view consistency, orphan elements, and circular dependencies, but the implementation only looks for file names and simple keyword presence in markdown. In a defense architecture verification workflow, this can create false assurance that a model has been meaningfully validated when critical structural inconsistencies remain undetected.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The verifier presents itself as a completeness and consistency validator, but it primarily performs existence checks and loose text matching, then emits PASS/WARNING/FAIL statuses that may be interpreted as substantive assurance. An attacker or careless user could craft minimally compliant-looking files that satisfy these heuristics while hiding major omissions or contradictions in the underlying DoDAF model.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The README explicitly promises generation of many files, diagrams, and consolidated reports, but it does not warn users that invoking the skill will create or modify workspace artifacts. This can lead to unexpected file creation, overwriting of existing documentation/report outputs, or user confusion about where data is written, especially in shared or sensitive project directories.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The skill plans to generate many documents and diagrams on disk but does not clearly warn users about file creation, output locations, or overwrite behavior. This can lead to unintended persistence of potentially sensitive architecture artifacts, accidental overwrites, or storage of classified-adjacent material in inappropriate locations.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The example pandoc command hard-codes `mainfont="SimSun"`, which imposes a specific CJK-oriented font choice and may not match the user's language or locale preferences. Under the language/locale policy, forcing a locale-specific output convention without opt-in should be avoided unless clearly justified.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The section titled "Domain-Specific Standards (Chinese Defense)" presents a China-specific standards set as part of the reference without indicating that this locale is optional, user-selected, or limited to a specific regional use case. Under the policy, locale-specific constraints should be explicitly opt-in or clearly justified.

Context-Inappropriate Capability

Low

• Confidence: 72% confidence
• Finding: The manifest focuses on creating, verifying, and documenting DoDAF models. While document export is in scope, invoking an external binary through subprocess introduces host command-execution capability that is broader and more sensitive than ordinary file generation, and the manifest does not disclose this implementation choice or dependency.

Static analysis

No suspicious patterns detected.