Wjs Auditing Project

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:08 AM UTC
• Version: 0.1.0

Overview

The skill has a coherent project-audit purpose, but it automatically inspects broad repository, GitHub, and local macOS/Xcode data and runs a network git fetch while describing the phase as read-only.

Install only if you want a broad Cathier-style project audit. Expect it to read repository history, planning files, GitHub PR/CI state, and some local macOS/Xcode diagnostic locations, and to contact the configured git remote during investigation. Review the checklist before approving fixes, especially merges, tags, stash changes, version bumps, or release steps.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:62

Finding

Unconditional Access to User-Level Logs Outside the Audited Repository

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62-65
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code

markdown

### F. App / system logs
- `ls -t ~/Library/Logs/DiagnosticReports/Cathier* 2>/dev/null | head -5` — recent crash reports for the app
- `log show --predicate 'process == "Cathier"' --last 1d --style compact 2>/dev/null | grep -iE "error|fault" | head -20` — recent runtime errors (skip silently if no install on this Mac)
- `ls -t ~/Library/Developer/Xcode/DerivedData/*/Logs/Build/*.xcactivitylog 2>/dev/null | head -3` — last build attempts (existence + mtime; don't try to parse)

Technical Analysis

The Skill directs the agent to inspect data outside the audited project directory, including user-wide macOS diagnostic reports, unified system logs, and Xcode build records. These sources may contain sensitive or unrelated information such as local usernames, filesystem paths, URLs, application identifiers, runtime state, and diagnostic details from other projects.

The instructions state that all Phase 1 checks should run without asking the user which checks are appropriate. The host-log checks are Cathier-specific, but the Skill can be selected for a general project audit. Consequently, invoking it against an unrelated repository could still cause access to Cathier logs and global Xcode metadata.

No instruction sends the collected data to an external attacker or expands operating-system privileges. The vulnerability is therefore a least-privilege and privacy-boundary violation rather than confirmed data exfiltration or privilege escalation.

Attack Path

1. A user invokes the Skill to audit a project, potentially one unrelated to Cathier.
2. The Skill instructs the agent to execute every Phase 1 check without requesting separate consent.
3. The agent accesses diagnostic reports and system logs under the user's home directory, outside the project boundary.

...[truncated 997 chars]

Remediation

View remediation

Remediation Suggestions

1. Make host-level log inspection optional and require explicit user consent before reading outside the repository.
2. Verify that the current repository is Cathier before running Cathier-specific commands.
3. Skip the entire section when the repository identity cannot be established.
4. Restrict DerivedData inspection to records demonstrably associated with the current Xcode project rather than using a wildcard covering every project.
5. Prefer asking the user to provide a specific crash report or build-log path.
6. Redact usernames, tokens, URLs, identifiers, and unrelated filesystem paths before including log evidence in a report.
7. Document clearly which external directories will be accessed and why.
8. Separate repository-only auditing from optional host diagnostics so the default workflow follows least privilege.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:29

Finding

State-Changing Network Fetch Misclassified as Read-Only Investigation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-35
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

Vulnerable Code

markdown

## Phase 1 — Investigate (parallel)

Run all the read-only checks in **one message with parallel Bash calls**. Don't ask the user which to run; run them all. Many will return "nothing wrong" — that's fine, those just don't show up in the checklist.

### A. Working tree & stashes
- `git status` — uncommitted work?
- `git stash list` — forgotten stashes?
- `git branch -vv` — local branches, ahead/behind tracking
- `git log --oneline main..HEAD` — what's on current branch not in main
- `git fetch origin --prune && git log --oneline HEAD..@{upstream}` — what's on remote not local

Technical Analysis

The Skill characterizes Phase 1 as read-only but requires git fetch origin --prune. A fetch performs network communication and updates local Git repository metadata, including remote-tracking references and fetch-related state. The --prune option can remove local remote-tracking references that no longer exist on the remote.

Although this command does not alter tracked working-tree files, it is not strictly read-only. It also assumes that contacting the configured origin is acceptable without obtaining user consent. A repository can contain an unexpected or untrusted remote URL, and running the command discloses that the repository is being accessed while potentially triggering authentication mechanisms.

The issue is an unsafe mismatch between the declared operational guarantee and the command's actual side effects. There is no evidence that the Skill configures a malicious remote or executes a downloaded payload.

Attack Path

1. A user invokes the Skill expecting the investigation phase to make no changes.
2. The Skill requires all checks to run and does not ask whether remote synchronization is permitted.
3. The agent executes git fetch origin --prune.

...[truncated 1230 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not describe Phase 1 as strictly read-only while it includes git fetch.
2. Present the initial report using existing local references, then offer remote synchronization as an optional freshness check.
3. Obtain explicit consent before contacting any configured remote.
4. Remove --prune from the default investigation workflow because pruning mutates local reference state.
5. Validate and display the remote URL before initiating network access.
6. If fetching is approved, use a non-pruning command such as git fetch origin and disclose that repository metadata will change.
7. Describe the phase as “working-tree preserving” if metadata updates are an intentional requirement.
8. Handle repositories without an upstream branch explicitly rather than assuming @{upstream} exists.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (7)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

Print the exact command they should run with a leading `!`:
- `! fastlane pilot upload` — App Store / TestFlight submission signs the binary; needs them
- `! open Cathier.xcodeproj` — anything that needs Xcode archive UI
- Anything destructive: `git reset --hard`, `git push --force`, deleting branches

## Common findings → standard fixes

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

Print the exact command they should run with a leading `!`:
- `! fastlane pilot upload` — App Store / TestFlight submission signs the binary; needs them
- `! open Cathier.xcodeproj` — anything that needs Xcode archive UI
- Anything destructive: `git reset --hard`, `git push --force`, deleting branches

## Common findings → standard fixes

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

| Local branch ahead of main, no PR | Rebase on main, push, `gh pr create` |
| PR failing CI on same step twice | Read failed log, fix root cause, don't blindly rerun |
| Unreleased commits + stale TestFlight | Bump build number, tag, write release notes, prompt user to run `fastlane pilot` |
| Stash >30 days, unclear context | Show `git stash show -p <n>` to user, ask drop/apply |
| TODOS.md item with no commit | Surface to user — descoped or forgotten? Don't assume |
| Auto-merged feedback PRs newer than last build | The fix is *a new TestFlight build*, not more code changes |
| `fastlane/` untouched but plan says App Store deadline passed | Surface the deadline + last submission date; user decides priority |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's trigger phrases are broad enough to match ordinary requests like 'make it right' or 'what's broken,' which can cause the audit workflow to activate unexpectedly. Because the workflow performs extensive repository and local-environment inspection, accidental invocation can expose branch names, logs, project plans, crash reports, and other sensitive context the user did not specifically ask to enumerate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The 'When to use' examples remain open-ended and lack boundaries, so the skill may trigger on ambiguous requests like returning to a project after time away or before a release. In context, this is risky because the skill is designed to immediately run multiple read-only checks across git, GitHub, local logs, and planning files, increasing the chance of over-collection beyond user intent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

The instruction to 'run them all' and 'don't ask the user which to run' removes an important consent boundary and causes automatic enumeration of repository state, CI status, planning docs, and local macOS logs. Even if the commands are nominally read-only, they may surface sensitive information unrelated to the user's immediate request, especially crash reports and system logs from the local machine.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

## Phase 1 — Investigate (parallel)

Run all the read-only checks in **one message with parallel Bash calls**. Don't ask the user which to run; run them all. Many will return "nothing wrong" — that's fine, those just don't show up in the checklist.

### A. Working tree & stashes
- `git status` — uncommitted work?

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction mandates ending with a specific Chinese sentence, which imposes a language choice regardless of the user's language preference. This is a natural-language policy issue because the file does not offer opt-in or justify a Chinese-only interaction requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.