Security audit

taichi

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real Redis-based multi-agent framework, but it also exposes broad command execution and weak safety checks that need review before installation.

Install only in an isolated development environment where you are comfortable with local command execution, Redis service changes, and workspace deletion. Do not use it with untrusted task text or on a machine with shared/production Redis until shell execution is disabled or sandboxed, task payloads are authenticated and validated, and Redis install/start/stop behavior is made explicitly user-controlled.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes shell commands, activates a virtual environment, and relies on environment variables and local filesystem paths, but it declares no permissions to do so. This creates a transparency and consent problem: users and policy layers cannot accurately assess or restrict what the skill is capable of before execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior presents the skill as a multi-agent orchestration framework, but the observed behavior includes privileged package installation, service lifecycle control for Redis, environment setup, shell/subprocess execution, and deletion of local data on uninstall. That mismatch is dangerous because users may authorize a seemingly narrow orchestration skill without realizing it can modify the host system, execute arbitrary commands, and remove local resources.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The installer automatically performs a privileged system package installation of Redis via sudo apt-get, which changes host state outside the skill directory and exceeds a minimal, user-consented skill setup flow. While Redis is plausibly required by the framework, silently attempting system-wide installation is dangerous because it grants the script authority to modify the OS and could be abused or surprise users in shared or production environments.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script automatically starts a background Redis daemon on the host using redis-server --daemonize yes, creating a persistent service and writing logs without explicit user confirmation. This is a host-level operational action beyond a typical local skill install and can affect system resources, conflict with existing configurations, or leave unintended services running.

Description-Behavior Mismatch

High

Confidence: 90% confidence
Finding: The manifest contents do not match the stated purpose of a Redis-based multi-agent coordination framework: instead of narrowly scoped coordination helpers, it defines generic command and script execution primitives. That mismatch is dangerous because it can conceal powerful execution capabilities behind an unrelated description, increasing the likelihood of unsafe deployment and misuse.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The bash_executor skill enables subprocess execution via a templated command field, which exposes command execution capability inside the agent environment. Even with an allowlist, this remains risky because argument injection, unsafe composition, and misuse of permitted interpreters or utilities can still lead to file access, data exfiltration, or execution of unintended logic.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The python_script skill allows execution of an arbitrary script path using python3, effectively granting broad code execution to any caller that can influence script_path. In context, this is especially dangerous because the framework is described as a coordination system, not a code-execution platform, so the capability is both unjustified and likely to bypass operator expectations.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The drafter unconditionally emits tasks for a bash executor and interpolates node['description'] into a shell command. Because the DAG arrives from a message payload and there is no validation, escaping, or allowlisting, an attacker who can influence node descriptions may trigger command injection or unauthorized shell execution downstream. In a multi-agent orchestration framework, adding implicit shell execution is especially dangerous because it expands the system from workflow coordination into arbitrary code execution.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: This is a true vulnerability because the component named and documented as a validator performs no meaningful completeness or safety checks beyond verifying that the task list is non-empty. In a multi-agent orchestration framework, downstream agents may rely on this approval as a trust boundary, so malicious, malformed, or unsafe tasks can be automatically greenlit and executed.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The executor constructs a shell command from a template with direct parameter substitution and runs it via asyncio.create_subprocess_shell, which invokes a shell interpreter. This creates a real command-injection and arbitrary command-execution surface: even if the first token is nominally whitelisted, shell metacharacters, chaining, redirection, subshells, or injected arguments can alter execution, and the framework context does not inherently require unrestricted shell access for multi-agent orchestration.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The code advertises whitelist enforcement but only checks allowed_commands and never enforces allowed_paths at all. This mismatch is dangerous because operators may rely on a documented path restriction that does not exist, allowing execution of binaries or scripts from unintended locations and weakening trust boundaries around skill definitions.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The worker executes whatever skill name is provided in the incoming task payload, defaulting to a shell-capable executor when no skill is specified. In a distributed system using a shared bus, any party able to publish or spoof task messages can trigger unintended code or command execution across workers, making this a strong remote-execution primitive rather than mere orchestration.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The drafter unconditionally emits tasks for a shell-capable skill (`bash_executor`) and interpolates planner-controlled node descriptions into a shell command string. In this orchestration context, that creates an unnecessary command-execution path and can become command injection or arbitrary command execution if upstream task content is attacker-influenced.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The validator claims to validate plans but approves any non-empty task list without checking skill names, parameters, risk level, or policy constraints. In a multi-agent framework that may dispatch generated tasks, this effectively disables a safety gate and allows dangerous or malformed tasks to proceed unchecked.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The worker executes whatever skill name is provided in the task, and if none is supplied it defaults to "bash_executor", which likely enables shell command execution. In a distributed multi-agent framework consuming tasks from a shared Redis queue, this creates a dangerous execution path where malformed, unintended, or attacker-injected tasks can trigger arbitrary command execution on the worker host.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The uninstall script shuts down any running `redis-server` on the host via `redis-cli shutdown` after only checking for a process name, without verifying that the Redis instance belongs to this framework. That can interrupt unrelated applications using a system or shared Redis service, making the uninstall action broader and more destructive than advertised.

Vague Triggers

Medium

Confidence: 74% confidence
Finding: Descriptions like 'Execute a bash command' and 'Run a Python script' are extremely broad and make these skills likely to be invoked for many loosely related requests. In an agent setting, overly broad triggers increase the chance that dangerous execution capabilities are selected unintentionally, turning ordinary prompting mistakes into command or code execution events.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: This file enables remote invocation of arbitrary skills, including a shell-oriented default, without any guardrail, disclosure, or explicit consent boundary in the execution path. While the core security issue is the unsafe execution capability itself, the lack of warning and policy enforcement increases the chance that dangerous behavior is triggered unexpectedly in normal operation.

Static analysis

No suspicious patterns detected.