Jumpstart

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:35 AM UTC
• Version: 1.0.1

Overview

This skill is coherent for long-running coding projects, but it needs review because it automatically runs a generated script and broadly commits repository changes.

Install only if you are comfortable with an agent modifying the repository and creating commits. Use it in a clean branch or disposable clone, review init.sh before any run, review git status and staged diffs before commits, and keep secrets or private local files outside the repository or covered by .gitignore.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:61

Finding

Unvalidated Execution of a Mutable Generated Shell Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61–64 and execution points at lines 130, 190, and 252
Vulnerability Type: Unvalidated shell-script generation and execution
Risk Level: High

Vulnerable Code

text

STEP 2 — Create init.sh:
A script that starts the development server and runs a basic end-to-end smoke test
(e.g., verify the server starts, the app loads, and one core interaction completes).
Make it runnable: chmod +x init.sh

Later workflows direct the agent to execute that mutable script:

text

4. Run `init.sh` to start the dev server and confirm there is no broken build.
   If it IS broken, fix the regression before starting new work.

The same execution instruction appears in the jumpsession, jumploop, and jumpfree workflows.

Technical Analysis

The initialization workflow directs an agent to generate an executable shell script based on project context. Subsequent sessions must execute that script without first inspecting its contents, verifying its provenance, checking a trusted hash, or obtaining approval after changes.

Because project files can influence generation and repository contributors can subsequently modify init.sh, this creates an arbitrary-command execution boundary. A malicious repository, compromised contributor, or attacker-controlled design document could cause the generated script to contain commands unrelated to smoke testing. The instructions provide no sandboxing, command allowlist, network restriction, integrity verification, or least-privilege requirement.

The project currently contains no malicious executable payload, so this finding concerns an exploitable workflow weakness rather than confirmed malicious behavior.

Attack Path

1. An attacker supplies malicious project or design content that influences generation of init.sh, or directly modifies an existing init.sh.
2. The victim invokes jumpsession, jumploop, or jumpfree.
3. The skill instructs the age ...[truncated 902 chars]

Remediation

View remediation

Remediation Suggestions

• Generate init.sh from a restrictive, reviewed template rather than unrestricted project prose.
• Display and inspect the complete script before its first execution.
• Require explicit approval before executing a newly created script or one whose content hash has changed.
• Validate the script against an allowlist of expected commands and reject command substitution, encoded payloads, unexpected interpreters, privilege changes, destructive filesystem operations, and unapproved network access.
• Execute smoke tests in an isolated container or sandbox with minimal filesystem access, no production credentials, and restricted networking.
• Run the script as an unprivileged account and enforce time, process, memory, and filesystem limits.
• Record and verify a trusted hash after review so subsequent sessions can detect modifications.
• Prefer a declarative task runner with explicitly enumerated commands over executing a mutable repository shell script.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:109

Finding

Overbroad Git Staging Can Commit Secrets and Unrelated Workspace Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 109, 144, 202, 261, and 382
Vulnerability Type: Unsafe broad staging of repository contents
Risk Level: Medium

Vulnerable Code

The initialization workflow uses:

text

git add -A && git commit -m "init: project scaffold, feature list, and environment setup"

Feature workflows similarly prescribe:

text

git add -A && git commit -m "feat([id]): [feature name] — [brief summary]"

The ad-hoc workflow prescribes:

text

git add -A && git commit -m "feat(jumpfree): [brief summary of work done]"

The startup checklist repeats the same broad staging behavior:

text

[ ] git add -A && git commit (per task, immediately after resolving)

Technical Analysis

git add -A stages every tracked modification, deletion, and untracked file under the repository rather than only files intentionally changed for the current task. The skill does not require review of git status, inspection of the staged diff, secret detection, or exclusion of unrelated user changes before committing.

As a result, sensitive local files, generated credentials, environment files, logs, build output, or unrelated work can be incorporated into permanent Git history. Even if a later commit deletes the material, the content remains recoverable from earlier Git objects and may be transmitted when the repository is pushed.

This issue can arise accidentally, but it is also exploitable: a malicious script or project action can place sensitive data in an unignored path and rely on the mandated broad staging command to preserve it in history.

Attack Path

1. A credential-bearing or otherwise sensitive file exists in the repository and is not excluded by .gitignore; alternatively, a malicious build or initialization script creates such a file.
2. The agent completes initialization, a feature, or an ad-hoc task.
3. The mandated git add -A command stages the sensitive file along with intended changes ...[truncated 934 chars]

Remediation

View remediation

Remediation Suggestions

• Replace git add -A with explicit staging of files intentionally modified by the current task, such as git add -- path/to/file1 path/to/file2.
• Require git status --short review before staging and git diff --cached --stat plus git diff --cached review before committing.
• Abort when unexpected untracked files, unrelated modifications, or sensitive filenames are detected.
• Maintain a defensive .gitignore covering environment files, credentials, private keys, logs, temporary files, and generated local configuration.
• Run secret scanning against both the working tree and staged diff before each commit.
• Separate pre-existing user changes from agent changes through a clean worktree, dedicated branch, or isolated clone.
• If a secret is committed, rotate it immediately and remove it from repository history using an appropriate history-rewriting tool; a follow-up deletion commit is insufficient.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly states that running jumpstart scaffolds files and makes an initial git commit, but it does not clearly warn users that invoking the skill will modify workspace contents and repository history. In an agent-execution context, undocumented write and commit behavior can lead to unintended state changes, accidental commits of sensitive material, or loss of review checkpoints before a user understands the side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The session commands are described as automatically selecting work, implementing code, updating logs, and committing changes, yet the README lacks an explicit warning that these commands are repository-modifying and may execute repeatedly in jumploop. In a long-running autonomous harness, this increases the risk of unreviewed code changes, cascading bad commits, and user surprise about the extent of automated modifications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says to use the skill not only for explicit commands like jumpstart but also whenever users want to build something substantial, ask about multi-session agents, preserving context, incremental work, or preventing premature completion. These conditions are broad, overlap with many ordinary software-development conversations, and do not provide clear exclusion boundaries or negative examples.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill instructs the agent to create files, chmod a script, generate tracking artifacts, and make an initial git commit without first requiring explicit user confirmation that repository modifications are desired. In environments where skill invocation may be automatic or loosely triggered, this can cause unintended state changes, pollute repositories, or commit sensitive local content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs execution of a local script (init.sh) and repository-changing git commands as routine session steps, but local scripts are untrusted workspace content and may execute arbitrary commands. This is especially risky because the skill itself also creates init.sh, and future sessions are told to run it automatically, creating a durable execution path for malicious or compromised script content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.