Autonomous Cascade

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:10 AM UTC
• Version: 1.0.0

Overview

The skill is a small autonomous workflow guide, but one example tells an agent to forcibly kill all Node.js processes without confirming they belong to the target gateway.

Review this skill before installing and avoid following the gateway example as written. If used, require the agent to identify the specific PID bound to port 18789, verify it is the intended gateway, try a graceful stop first, and ask before any forced termination.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:42

Finding

Overbroad Forced Termination of Node.js Processes

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-43
Vulnerability Type: Overbroad destructive process management
Risk Level: Medium

text

ACT: taskkill /F /IM node.exe
EVALUATE: gekillt → neu starten

Technical Analysis

The gateway-diagnostic example instructs the agent to execute taskkill /F /IM node.exe. Selecting processes by image name causes the command to target every accessible node.exe process rather than only the process associated with the gateway on port 18789. The /F option also forces termination, preventing graceful shutdown and cleanup.

This violates least-scope process-management practices. Although the command appears in an example rather than executable code, an agent applying the documented workflow may execute it directly during gateway diagnosis.

Attack Path

1. A user or automated workflow requests diagnosis of a gateway issue.
2. The agent follows the documented autonomous cascade example.
3. The agent executes taskkill /F /IM node.exe.
4. Windows selects all accessible processes whose image name is node.exe.
5. The processes are forcibly terminated without verifying their relationship to port 18789 or the gateway.
6. Unrelated Node.js services, development servers, or active jobs are disrupted.

No privilege-escalation mechanism is present: the command can terminate only those processes permitted by the agent's existing execution context.

Impact Assessment

Successful execution can cause denial of service for unrelated Node.js applications within the account's process-control scope. Forced termination may interrupt requests, background jobs, and development sessions, and may cause loss of unsaved or in-memory state. If the agent already runs with elevated privileges, the disruption could extend to Node.js services owned by other users or the system; the Skill itself does not obtain those elevated privileges.

Remediation

View remediation

Remediation Suggestions

Replace image-wide forced termination with a narrowly scoped and verified procedure:

1. Identify the PID listening on port 18789 using Get-NetTCPConnection, netstat -ano, or an equivalent trusted mechanism.
2. Verify that the PID belongs to the intended gateway by checking its executable path, command line, owner, and expected working directory.
3. If no verified gateway process owns the port, stop and report the discrepancy rather than terminating unrelated processes.
4. Request user confirmation before destructive process termination unless prior authorization explicitly covers that action.
5. Attempt graceful shutdown of only the verified PID or use the gateway's supported stop command.
6. Use forced termination solely as an explicitly approved fallback after graceful shutdown fails.
7. Confirm that port 18789 has been released before restarting the gateway, and verify the health endpoint afterward.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly includes a forceful process-kill action (taskkill /F /IM node.exe) as part of an autonomous loop, but it does not require user confirmation, scope limitation, or validation that the targeted process is the intended gateway. In an automated agent context, this can terminate unrelated Node.js workloads, causing service disruption or data loss and making the pattern materially risky.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language instructions throughout the file are presented only in German, which can impose a language requirement on users without opt-in. The file does not indicate that the skill is intentionally region-specific or provide any language/locale choice.

Content

No source excerpt is available for this finding.