Taku Build

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:12 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent coding workflow, but its worktree path can automatically modify git state and run dependency/build commands without an explicit safety checkpoint.

Install only if you are comfortable with an implementation skill that may run tests, create branches/worktrees, edit .gitignore, commit that change, and install/build project dependencies. Use extra caution on unfamiliar repositories; review and approve dependency or build commands before allowing setup to proceed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: references/worktrees.md:62

Finding

Automatic Execution of Unreviewed Repository Dependencies

Content

View full analysis

Vulnerability Details

File Location: references/worktrees.md:62-66
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code:

bash

[ -f package.json ] && npm install
[ -f Cargo.toml ] && cargo build
[ -f requirements.txt ] && pip install -r requirements.txt
[ -f pyproject.toml ] && poetry install
[ -f go.mod ] && go mod download

Technical Analysis

The worktree setup instructions automatically select and execute package-management or build commands based solely on the presence of repository-controlled manifest files. They do not require prior inspection of dependency declarations, lockfiles, package sources, lifecycle scripts, or build hooks.

Several listed commands can execute third-party or repository-controlled code:

• npm install can execute dependency and project lifecycle scripts.
• cargo build can execute Rust build scripts such as build.rs.
• Python dependency installation can invoke package build backends and installation hooks.
• Other package managers can retrieve dependencies from external registries and process repository-controlled configuration.

The guidance does not require explicit user approval before these operations, immutable lockfile modes, trusted-source validation, disabled installation scripts, restricted network access, or sandboxing. Consequently, merely opening an untrusted repository and requesting worktree setup can cross from static repository inspection into local code execution.

Attack Path

1. An attacker creates or compromises a repository containing a recognized manifest such as package.json, Cargo.toml, requirements.txt, or pyproject.toml.
2. The attacker adds a malicious dependency, lifecycle script, build script, or package build hook.
3. A user asks the Skill to create an isolated worktree for that repository.
4. The Skill detects the manifest and automatically runs the corresponding installation ...[truncated 1151 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user approval before installing dependencies or invoking any build system, especially for repositories that have not been reviewed.
2. Inspect manifests, lockfiles, package-manager configuration, lifecycle scripts, Rust build scripts, and Python build backends before execution.
3. Enforce immutable, lockfile-based installation where available, such as npm ci rather than unconstrained npm install.
4. Disable installation scripts when they are not required, for example with npm ci --ignore-scripts, and only enable them after review.
5. Restrict package sources to approved registries and validate dependency names and resolved origins to reduce dependency-confusion and typosquatting risk.
6. Run dependency installation and builds in a sandbox or disposable container with minimal filesystem access, no sensitive credentials, and restricted outbound networking.
7. Separate dependency download from code execution where supported, and report the planned commands and security implications before running them.
8. Pin dependency versions and verify lockfile integrity or package checksums when the ecosystem supports it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/tdd.md (reported line 83)May include surrounding context.

md

Run all tests. Confirm:
- New test passes
- All existing tests still pass
- Output is clean (no warnings, no skips)

### REFACTOR — Clean Up

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad and include common requests such as 'start coding', 'build this', and multilingual variants that can easily match ordinary user intent without a narrowly scoped handoff from a prior planning step. In a skill that can execute implementation work and set up worktrees, over-broad activation increases the chance of unintended code changes or autonomous execution in contexts where the user did not explicitly mean to invoke this high-impact skill.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

4. Use `references/worktrees.md` only when isolation is needed.
5. Choose execution mode yourself: sequential, parallel, or hybrid.

Do not ask the user to choose a mode unless the choice changes product scope,
cost, or risk.

## Output Contract

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest-style description says the skill should be used "whenever writing implementation code" and "when the user starts implementing a feature." These conditions are broad and lack clear boundaries or exclusions, making unintended invocation likely during many ordinary coding tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list is broad and overlaps with common development requests such as 'start a feature branch' and build-phase work, which can cause the skill to activate in contexts the user did not explicitly intend. Because this skill performs git operations, dependency installation, and test execution, ambiguous invocation increases the chance of unexpected repository changes and execution of project-defined install/test scripts.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/worktrees.md (reported line 121)May include surrounding context.

md

## Known Pitfalls

**Creating worktree without checking gitignore.** A worktree was created in `.worktrees/my-feature`. After implementing the feature, `git status` showed 2,000+ untracked files — the worktree's `node_modules/` and build artifacts. The entire worktree contents were about to be committed.

*What went wrong:* The gitignore check was skipped because "it usually works." The `.worktrees/` directory wasn't in `.gitignore`, so git saw everything inside it as untracked files.