Security audit

Adaptive Team Research

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed multi-agent software review workflow that reads project files and writes a bounded review report, with no evidence of hidden execution, exfiltration, or persistence.

Before installing, expect the skill to spawn several review agents, read the target project, and create a review canvas under the project reviews/ directory. Users who need English output or strict no-write operation should request those constraints explicitly before running it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The natural-language instructions and user-facing content in the body of the skill are written in Chinese, which can force a specific language experience on users without opt-in. The file does not state that the skill is region-specific or offer an alternative language choice for operation.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill states that it only produces analysis reports and action plans, but later requires creating a directory and writing a review canvas file into the project workspace. This mismatch can cause an agent or user to assume the skill is read-only when it actually performs filesystem writes, which undermines informed consent and safe execution boundaries.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The documentation presents the skill as analysis-only, yet operational steps instruct it to create directories and a standalone file. This internal contradiction is risky because downstream orchestration systems may classify or permit the skill based on the earlier, less-privileged description and then allow unexpected writes during execution.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to create `reviews/` and write `reviews/{project-name}-review.md` without any explicit warning or separate approval for modifying the workspace. In an agent setting, silent writes can overwrite expectations, clutter repositories, or create artifacts in sensitive directories if the project name or working path is mishandled.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: 该 markdown 模板的标题、章节说明和占位提示均为中文，整体上将技能输出/使用语境固定为单一语言。根据规则，若未提供用户语言选择或未明确说明这是特定区域/语言场景专用模板，则属于语言/locale 策略违规。

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The file is entirely written in Chinese and does not indicate that language selection is based on user preference or an explicit opt-in. In a multi-agent review skill, this can cause agents to respond in a language the user did not request, leading to misunderstandings, inaccessible outputs, and degraded safety review quality if users cannot verify recommendations or warnings.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The shared Round 1 rule at L020 imposes a strict 'facts only, no evaluation, no suggestions' constraint for all prompts. However, the PM lead prompt later requires '匹配度分析' and '矛盾描述检测' at L063, which goes beyond pure factual extraction into evaluative analysis, directly conflicting with the stated universal constraint.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The universal instruction at L020 says all Round 1 roles must only record facts and avoid evaluation. Yet L064-L066 ask the PM lead to analyze missing subfeatures, dependency impacts, competitor implementation depth, and infer actual usage scenarios, which are interpretive judgments rather than strictly factual observations.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: L020 establishes a no-evaluation rule for every Round 1 prompt. In contrast, the Designer lead additions at L127-L130 require validating touch target sizing, aria correctness, color contrast, keyboard navigation support, and interaction architecture, which are assessment-oriented tasks rather than raw fact gathering.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The file states at L010-L020 that the Round 1 rules apply to all roles and require facts only. However, L189-L193 direct the Engineer lead to perform algorithmic complexity analysis, bottleneck identification, consistency guarantees, and full auth-chain/security pattern analysis, all of which are higher-order evaluative analyses that contradict the documented Round 1 intent.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This markdown file defines all role prompts and instructions exclusively in Chinese, including required output formats and behavioral rules. Because the file does not provide an opt-in language choice or explain that the skill is intentionally limited to a Chinese-language context, it creates a language/locale policy concern under the natural-language policy rule.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This markdown file contains operational instructions entirely in Chinese, including headings, procedures, and required actions, but does not indicate that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The protocol instructs the Team Lead to create and write a file under the project repository (`reviews/{project-name}-review.md`) without any explicit user consent, warning, or safety boundary. In an agent setting, silent repository modification can cause unintended workspace changes, pollute commits, overwrite existing review artifacts, or be chained with other instructions to persist attacker-influenced content.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The table states Round 1 and Round 2 only need to read code or the canvas and therefore do not need file writing. However, the protocol explicitly requires the Team Lead to create `reviews/{project-name}-review.md` and write Round 1 and Round 2 content into that canvas, so the documentation's justification about write behavior is contradicted by the documented workflow itself.

Static analysis

No suspicious patterns detected.