Security audit

Idea Darwin

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local idea-management workflow that creates and updates project files, with some prompt-injection and broad-trigger risks users should understand.

Install only if you want a skill that maintains local idea-project state in the current workspace. Use it on trusted idea files, review the files it creates before running multiple rounds, and avoid feeding it shared or untrusted idea documents until prompt-injection boundaries are strengthened.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: references/prompts.md:9
Finding: Untrusted Idea Content Is Interpolated into Agent Prompts Without Injection Boundaries
Content: View full analysis
Remediation: View remediation
{idea_card} ``` 3. Apply the same controls to every interpolated field that may contain user-derived content, particularly `{related_ideas_summary}` and externally maintained `stimuli.md` entries. 4. Enforce an operation allowlist: - Limit each action to documented transformations and project-relative files. - Reject requests originating in card content to access unrelated paths, networks, credentials, memory stores, shells, or external tools. - Require explicit user confirmation before any operation outside the initialized project structure. 5. Validate generated output before writing it: - Confirm that destination paths remain inside the project directory. - Reject absolute paths and traversal sequences such as `../`. - Validate structured JSON, YAML, and Markdown fields against expected schemas. - Prevent generated content from changing configuration keys that are outside the current operation. 6. Add prompt-injection regression tests using cards that contain role overrides, requests to ignore previous instructions, tool invocation requests, data-exfiltration instructions, and forged prompt delimiters. Verify that such text is analyzed as inert idea content and never executed. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is configured to auto-trigger on a very broad set of common ideation phrases and even on general tasks involving file-based idea structuring, ranking, or iteration. That can cause unintended activation in unrelated contexts, leading the agent to create directories, read local files, and modify workspace state without sufficiently explicit user intent, which is a security and safety boundary issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill description does not prominently warn users that running initialization or rounds will create and update multiple files in the working directory, including config, cards, reports, and graph data. In context, this matters because the skill performs broad workspace writes as a core behavior, so lack of upfront disclosure increases the chance of surprising or unauthorized modifications to user projects.
Content: No source excerpt is available for this finding.