OC Team Builder

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:51 AM UTC
• Version: 2.0.0

Overview

This skill is mostly coherent as a team-planning and experiment-automation tool, but its Research Lab workflow grants broad unattended command, compute, and repository-changing authority without adequate safeguards.

Install only if you intend to use local experiment automation and are comfortable reviewing every command before it runs. Run it in a disposable clone or sandbox, avoid unattended or overnight loops, do not pass untrusted --run-cmd, --metric-cmd, --file, project paths, or agent definitions, and treat any generated git commits, branches, ledgers, or review logs as user-visible side effects.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: references/TEAM-RESEARCH.md:9

Finding

Research workflow instructs the agent to operate indefinitely without human oversight

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/experiment.sh:54

Finding

User-controlled experiment commands are executed through shell evaluation

Content

View full analysis

/dev/null | head -1 | awk '{print $NF}' || echo "") ``` ```bash start_time=$(date +%s) timeout $((budget * 2)) bash -c "$run_cmd" || true end_time=$(date +%s) elapsed=$((end_time - start_time)) metric=$(eval "$metric_cmd" 2>/dev/null | head -1 | awk '{print $NF}' || echo "") ``` ### Technical Analysis The `--run-cmd` and `--metric-cmd` options accept arbitrary strings. Those strings are subsequently interpreted by a shell using `eval` or `bash -c`. Shell metacharacters, command substitutions, pipelines, redirections, and compound commands are therefore executed rather than treated as literal arguments. There is no command allowlist, executable validation, argument separation, restricted environment, privilege reduction, or confirmation prompt. The setup path uses `eval` without even applying the timeout used by the run path. This behavior creates a direct command-execution interface. It becomes especially dangerous when command values are copied from untrusted project documentation, generated by another agent, supplied by an untrusted automation layer, or derived from attacker-controlled task content. ### Attack Path 1. An attacker influences an invocation of `experiment.sh`, directly or through an agent-generated command. 2. The attacker supplies a crafted value to `--run-cmd` or `--metric-cmd`, for example a legitimate benchmark command followed by an additional shell command. 3. Argument parsing stores the complete string without val ...[truncated 1164 chars]

Remediation

View remediation

run.log 2>&1 ``` - If customization is required, accept a path to an executable plus repeated argument options, and invoke it without shell reparsing. - Validate executable paths against an explicit allowlist or trusted project root. - Implement metric extraction internally rather than executing a user-supplied shell pipeline. - Require explicit confirmation before any custom executable is run. - Run experiments in a sandbox or container with: - A minimal environment. - No unnecessary credentials. - Restricted network access. - A read-only filesystem except for designated project and output paths. - CPU, memory, process, and wall-clock limits. - Apply a timeout during baseline setup as well as subsequent runs. - Reject malformed option values and validate that `budget` is a bounded positive integer. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/activate.sh:75

Finding

Agent activation accepts and prints arbitrary readable local files

Content

View full analysis

&2 exit 1 fi agent_file="$file" ``` ```bash agent_name=$(head -5 "$agent_file" | grep -i "^name:" | head -1 | sed 's/^name:\s*//') agent_desc=$(head -5 "$agent_file" | grep -i "^description:" | head -1 | sed 's/^description:\s*//') echo "=== ACTIVATED: $agent_name ===" echo "Source: $agent_file" echo "Description: $agent_desc" echo "---" echo "" if $personality_only; then sed -n '/^#/,$p' "$agent_file" else cat "$agent_file" fi ``` ### Technical Analysis The documented purpose of `--file` is to load an agent Markdown definition. However, the implementation only verifies that the supplied path is a regular file. It does not canonicalize the path, require a `.md` extension, or verify that the resolved path remains within the trusted agency-agent directory. The selected file is then printed with `cat`, or partially printed with `sed` when `--personality-only` is enabled. Consequently, any file readable by the invoking user can be used as an activation source and emitted to standard output. In an agent environment, standard output may be inserted into model context, logs, orchestration transcripts, or downstream messages. This turns a local path argument into a potential sensitive-file disclosure channel. ### Attack Path 1. An attacker persuades a user or agent to activate a purported personality file using `--file`. 2. The supplied path points to a sensitive readable file outside the agent-definition directory. 3. The script checks only that the target is a regular file. 4. The path is assigned directly to `agent_file`. 5. Unless `--personality-only` is used, `cat "$agent_file"` emits the complete contents. 6. The contents may th ...[truncated 816 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents a multi-roster team orchestration capability: discovering specialists from three rosters, composing teams, activating them, and using planner/reviewer roles. The supplied code only provides a local CLI for browsing one agency directory and printing a selected agent's Markdown/personality content. While the word 'activate' appears in both, the implementation is much narrower: it selects a single file from the Agency Division and outputs it. There is no evidence of team composition, cross-roster discovery, planner/reviewer logic, autonomous research loops, or deliverable validation. This is a material description-behavior mismatch, not just an implementation detail omission.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description centers on discovering and assembling specialist teams from rosters and having planner/reviewer roles validate work. None of that behavior appears in the code. Instead, the script is an experiment automation utility modeled on autoresearch: it operates on a local project, executes configurable shell commands, uses git for branch and commit management, extracts metrics, and tracks outcomes in a ledger. This is a materially different primary purpose with several undeclared operational capabilities. Therefore the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description centers on team-building and orchestration across named rosters, plus planner/reviewer roles. The supplied code does not implement any roster access, team selection, agent activation, planning, or autonomous research behavior. Instead, it only creates a markdown review checklist/template for QA review of a task and saves it to a log/output file. While the description mentions a reviewer validating deliverables, this script merely scaffolds a review document and does not perform the broader advertised team-builder functionality. Therefore the actual behavior is materially narrower and different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code supports only the 'discover' portion of the description by listing agents from three rosters and allowing filtering by roster, division, and search query. There is no logic for composing teams, selecting optimal specialists, activating agents, running autonomous research loops, or reviewing/validating deliverables. The declared description therefore materially overstates the skill's implemented capabilities relative to this code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

| `SKILL.md` | This file — overview, scripts, quick start |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

git reset --hard HEAD~1 is a destructive command that discards local changes and rewrites working state. In a skill document intended for agent consumption, including this as a routine autonomous action creates clear potential for data loss and unauthorized rollback of user work.

Content

Scanner excerpt · references/TEAM-RESEARCH.md (reported line 216)May include surrounding context.

Run: uv run train.py > run.log 2>&1 Result: val_bpb 1.0050 (worse than 0.9932) Decision: DISCARD — regression, reverted Action: git reset --hard HEAD~1

text

**Experiment 3: Reduce model depth, increase width**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This second use of git reset --hard HEAD~1 repeats the same destructive rollback pattern after a crash scenario, normalizing unsafe repository manipulation as part of autonomous behavior. Crash handling is already a high-risk context, and adding hard resets can compound failures with irreversible loss of intermediate work.

Content

Scanner excerpt · references/TEAM-RESEARCH.md (reported line 226)May include surrounding context.

Run: uv run train.py > run.log 2>&1 Result: OOM crash — grep output empty, tail shows CUDA OOM Decision: CRASH — too much VRAM, reverted Action: git reset --hard HEAD~1

text

### Final Ledger

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script accepts --metric-cmd and --run-cmd as user input and later executes them with eval/bash -c, which permits arbitrary shell execution in the context of the user running the skill. In a skill advertised for team composition rather than local experiment orchestration, this materially expands the attack surface and can be abused for command execution, data access, or destructive local actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Most of the script implements autonomous experiment execution, metric extraction, timeout handling, git branching, checkout, and commit behavior, which is unrelated to the declared skill purpose of discovering and activating specialist teams. This scope mismatch is dangerous because users may grant trust appropriate for a planning skill while the code performs local repository mutation and experiment automation with side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The setup flow creates or switches git branches and the run flow later commits or reverts tracked files, mutating the user's repository state automatically. In the context of a team-builder skill, these repository actions are not justified by the manifest and could overwrite work, alter history expectations, or conceal unreviewed changes under automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill prominently promotes autonomous experiment loops but provides no upfront safety warning that these workflows may consume significant compute, alter repositories, or run project-specific commands. In a skill context where users may copy-paste commands directly, missing warnings can lead to unintended execution with operational or integrity consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented experiment commands invite users to initialize and run automation against arbitrary project paths without warning that these actions may change files, execute training or shell workflows, and consume local or remote resources. That omission increases the likelihood of accidental destructive or expensive actions by users who treat the commands as low-risk documentation examples.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Describing the research loop as something that can 'loop forever' signals potentially unbounded execution and resource consumption. In the context of autonomous experiment tooling, this can lead to runaway compute usage, excessive API costs, persistent disk churn, or repeated code mutations if users enable continuous operation without hard limits.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

| Specialized | 7 | Agents Orchestrator, Data Analytics, LSP Engineer |

### 3. Research Lab (`references/TEAM-RESEARCH.md`)
Autonomous experiment loops adapted from Karpathy's [autoresearch](https://github.com/karpathy/autoresearch). Set up a measurable experiment, run it in a fixed time budget, keep improvements, discard failures, loop forever.

Source code reference: `reference/autoresearch-master/` (program.md, train.py, prepare.py)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly proposes an autonomous research loop that runs overnight and even says it runs indefinitely until manually stopped, while modifying and executing train.py. That describes potentially impactful code execution without any safety warning, guardrails, resource limits, approval checkpoints, or isolation requirements, which could lead users to launch uncontrolled experiments that consume compute, alter code, or produce unsafe changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to 'activate any specialist' by reading an external definition file and 'adopt their role' is broad delegation guidance without clear trust boundaries, approval gates, or safety constraints. In a multi-agent skill, this can cause unintended persona adoption, prompt-scope expansion, or invocation of risky downstream instructions from referenced agent files, especially because those files are treated as authoritative operational specs.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The phrase 'loop forever' endorses unbounded execution and resource consumption. In an agent skill, that is dangerous because it can lead to runaway compute usage, prolonged unattended modifications, and persistent command execution without a termination condition.

Content

Scanner excerpt · references/TEAM-RESEARCH.md (reported line 3)May include surrounding context.

md

# Research Lab — Autonomous Experiment Methodology

Adapted from Karpathy's [autoresearch](https://github.com/karpathy/autoresearch) framework. The core idea: set up a measurable experiment, run it in a fixed time budget, keep improvements, discard failures, and loop forever.

This methodology is **not limited to ML training**. It applies to any domain with a measurable metric: image analysis pipelines, prompt engineering, configuration tuning, data processing, performance optimization, and more.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file promotes a fully autonomous, never-ending experimentation loop without warning about unattended code changes, shell execution, costs, or system impact. In a skill context, omission of those safeguards increases the chance that an agent runs risky operations continuously without human oversight.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The explicit LOOP FOREVER instruction operationalizes indefinite autonomous experimentation rather than merely describing a concept. Combined with code modification and experiment-running steps, it materially increases the risk of runaway activity and repeated side effects on repositories and systems.

Content

Scanner excerpt · references/TEAM-RESEARCH.md (reported line 20)May include surrounding context.

The Experiment Loop

text

LOOP FOREVER:
  1. Review current state (baseline metric, recent experiments)
  2. Propose a hypothesis — what change might improve the metric?
  3. Implement the change (modify only the in-scope file/config)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This documentation instructs an agent to autonomously modify code, execute experiments, and continue indefinitely, which exceeds the stated purpose of a team-composition skill. In context, these are operational instructions that could drive real code changes and command execution without bounded authorization, creating a meaningful risk of unintended system modification and resource consumption.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

Here LOOP FOREVER is paired with git and shell actions, making the unbounded behavior directly actionable. This is especially risky because the loop can repeatedly commit, run programs, inspect logs, and reset history with no built-in approval or global resource ceiling.

Content

Scanner excerpt · references/TEAM-RESEARCH.md (reported line 61)May include surrounding context.

The autoresearch Loop (verbatim from program.md)

text

LOOP FOREVER:
  1. Look at the git state: the current branch/commit we're on
  2. Tune train.py with an experimental idea by directly hacking the code
  3. git commit

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The embedded autoresearch loop explicitly directs shell execution, git commits, log scraping, crash inspection, and branch advancement/reversion. Those actions are unrelated to a team-builder’s declared function and would grant an agent a workflow for autonomous repository manipulation and command execution if followed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions include git reset reversion behavior without warning that it can discard local work and alter repository state. In an autonomous-agent setting, destructive version-control commands are especially dangerous because they can erase changes without the user’s knowledge or a recovery plan.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script initializes and appends to a results ledger inside the target project and treats an arbitrary file as modifiable in-scope state. Persistent local experiment management is consistent with autoresearch tooling, but it is not justified by a manifest focused on composing specialist teams from rosters.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script executes the configurable run_cmd directly, and in do_run wraps it in bash -c, with no safety warning or guardrails. This is dangerous because users may treat the option as a benign experiment parameter when it actually grants full shell execution, enabling arbitrary commands, exfiltration, or destructive operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script evaluates metric_cmd via eval, so a value that appears to be a simple metric extractor can execute arbitrary shell syntax. Because metric extraction is expected to be read-only, this hidden execution path is especially risky and can surprise users with code execution in a trusted workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.