Security audit

Codegraph Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is a code-indexing helper, but its memory-writing command can persist untrusted project/tool output into MEMORY.md without confirmation or containment.

Install only if you are comfortable letting the skill index the chosen project and run the globally installed CodeGraph executable. Avoid using inject on untrusted repositories, inspect MEMORY.md after use, and prefer adding confirmation, backups, explicit markers, and untrusted-output delimiters before relying on this in agent memory workflows.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

Location: codegraph_assist.py:66
Finding: Untrusted CodeGraph Output Written to Persistent Agent Memory
Content: View full analysis
Remediation: View remediation
` and ``, and replace only content between the exact paired markers. 6. Preserve unrelated memory content and create a backup before modifying an existing file. Use an atomic write through a securely created temporary file followed by replacement. 7. Restrict the target path to an explicitly approved project root and verify that `MEMORY.md` is not a symbolic link before writing. 8. Check CodeGraph return codes and abort injection if either subprocess fails; do not persist partial, malformed, or unexpected output. 9. Pin and verify the expected CodeGraph installation or executable integrity to reduce the risk of compromised tool output entering persistent memory. ]]>

SkillSpector

Vulnerability Patterns

Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises shell execution plus file read/write behavior but does not declare any explicit tool scope or permission boundaries. In an agent environment, this increases the chance the skill can be invoked with broader-than-necessary capabilities, enabling unintended command execution, filesystem modification, or data exposure if the wrapper or downstream commands are abused.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description and examples present the skill as operating in Chinese only (for example, '一句话拿到项目结构' and commands like ask "你的问题"), with no indication that users may choose another language. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · codegraph_assist.py (reported line 22)May include surrounding context.
python
def run_cg(args, cwd=None, timeout=120): """Run codegraph command, return (stdout, stderr, returncode).""" r = subprocess.run( [CODEGRAPH_BIN] + args, cwd=cwd, capture_output=True, text=True, timeout=timeout )