Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. Read this `SKILL.md` for the task-specific workflow.
Security audit
Implementing Architecture
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed workflow skill for implementing a human-approved architecture, with strong human approval gates and no evidence of hidden persistence, exfiltration, or destructive behavior.
Install this only if you intend to use the arch-compiler workflow. Expect it to read project architecture and requirement files and to help modify application code after confirmation. Verify that any local ~/.codex/arch-compiler helper it runs comes from a trusted arch-compiler installation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md 1. Read `AGENTS.md` for repo-wide agent rules and boundaries. 2. Read this `SKILL.md` for the task-specific workflow. 3. Treat `tools/`, `schemas/`, `config/`, and `patterns/` as read-only unless the human explicitly asks for compiler-maintenance work in this repo. 4. Use this skill only when `docs/architecture/` already exists and is approved. If architecture is missing or unapproved, switch to `skills/compiling-architecture/SKILL.md` instead of inventing architecture choices. The important split is: - `AGENTS.md` = global agent rules for this repo
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md 1. Read `AGENTS.md` for repo-wide agent rules and boundaries. 2. Read this `SKILL.md` for the task-specific workflow. 3. Treat `tools/`, `schemas/`, `config/`, and `patterns/` as read-only unless the human explicitly asks for compiler-maintenance work in this repo. 4. Use this skill only when `docs/architecture/` already exists and is approved. If architecture is missing or unapproved, switch to `skills/compiling-architecture/SKILL.md` instead of inventing architecture choices. The important split is: - `AGENTS.md` = global agent rules for this repo
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md 1. Read `AGENTS.md` for repo-wide agent rules and boundaries. 2. Read this `SKILL.md` for the task-specific workflow. 3. Treat `tools/`, `schemas/`, `config/`, and `patterns/` as read-only unless the human explicitly asks for compiler-maintenance work in this repo. 4. Use this skill only when `docs/architecture/` already exists and is approved. If architecture is missing or unapproved, switch to `skills/compiling-architecture/SKILL.md` instead of inventing architecture choices. The important split is: - `AGENTS.md` = global agent rules for this repo
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md 1. Read `AGENTS.md` for repo-wide agent rules and boundaries. 2. Read this `SKILL.md` for the task-specific workflow. 3. Treat `tools/`, `schemas/`, `config/`, and `patterns/` as read-only unless the human explicitly asks for compiler-maintenance work in this repo. 4. Use this skill only when `docs/architecture/` already exists and is approved. If architecture is missing or unapproved, switch to `skills/compiling-architecture/SKILL.md` instead of inventing architecture choices. The important split is: - `AGENTS.md` = global agent rules for this repo
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md 1. Read `AGENTS.md` for repo-wide agent rules and boundaries. 2. Read this `SKILL.md` for the task-specific workflow. 3. Treat `tools/`, `schemas/`, `config/`, and `patterns/` as read-only unless the human explicitly asks for compiler-maintenance work in this repo. 4. Use this skill only when `docs/architecture/` already exists and is approved. If architecture is missing or unapproved, switch to `skills/compiling-architecture/SKILL.md` instead of inventing architecture choices. The important split is: - `AGENTS.md` = global agent rules for this repo
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md 1. Read `AGENTS.md` for repo-wide agent rules and boundaries. 2. Read this `SKILL.md` for the task-specific workflow. 3. Treat `tools/`, `schemas/`, `config/`, and `patterns/` as read-only unless the human explicitly asks for compiler-maintenance work in this repo. 4. Use this skill only when `docs/architecture/` already exists and is approved. If architecture is missing or unapproved, switch to `skills/compiling-architecture/SKILL.md` instead of inventing architecture choices. The important split is: - `AGENTS.md` = global agent rules for this repo
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md The important split is: - `AGENTS.md` = global agent rules for this repo - `skills/using-arch-compiler/SKILL.md` = workflow router - `skills/compiling-architecture/SKILL.md` = how to compile and finalise architecture - `skills/implementing-architecture/SKILL.md` = how to implement an already-approved architecture
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - `AGENTS.md` = global agent rules for this repo - `skills/using-arch-compiler/SKILL.md` = workflow router - `skills/compiling-architecture/SKILL.md` = how to compile and finalise architecture - `skills/implementing-architecture/SKILL.md` = how to implement an already-approved architecture ---
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language instruction says '
constraints.language— implement in this language only,' which imposes a hard language choice. Under the policy for this audit, forcing a specific language without opt-in is a natural-language policy violation unless clearly justified as a documented constraint for a specific regional or compliance context, which is not stated here.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Mistake | Fix | |---------|-----| | Starting to code without functional requirements | Stop — architecture tells you HOW, not WHAT. Get feature specs from the human first. | | Assuming a pattern is irrelevant without checking the full picture | e.g. `hosting-static-frontend--netlify` looks irrelevant for a mobile app until you check `ui-cross-platform` defaultConfig — Flutter targets web too. Cross-check pattern `provides`/`requires` before dismissing any selected pattern. If you confirm it genuinely can't be implemented in the current context, raise it with the human — do not skip silently. | | Writing token code to satisfy a pattern (log line, comment, stub) | This is a silent skip. If you cannot deliver every capability in `provides`, follow the unimplementable pattern workflow — stop, raise with human, add to `disallowed-patterns` if agreed. | | Reading compiled-spec.yaml or a prior summary instead of the pattern JSON | `compiled-spec.yaml` has `defaultConfig` but not `provides` or `requires`. Read `patterns/<id>.json` directly, immediately before implementing each pattern. | | Choosing a service not in `defaultConfig` | Check `configSchema` — if it's not in the enum, it wasn't approved |
Static analysis
No suspicious patterns detected.