Security audit

Improvement Executor

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to edit and roll back project files, but its scripts can be steered by artifacts or command-line paths to modify or copy arbitrary writable local files.

Review before installing. Use this only in a tightly controlled workspace with trusted ranking, receipt, and execution artifacts. Do not run it on untrusted artifacts, avoid --force and rollback --execute unless you have verified the paths, and run it as a low-privilege user because the current scripts can write anywhere that user can write.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/execute.py:264
Finding: Unrestricted Modification of Attacker-Selected Files
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/rollback.py:167
Finding: Arbitrary Local File Copy and Overwrite Through Rollback Paths
Content: View full analysis
dict: backup_file = Path(backup_path) target_file = Path(target_path) if not backup_file.exists(): return { "status": "error", "reason": f"Backup file not found: {backup_path}" } result = { "status": "dry_run" if dry_run else "success", "action": "rollback", "target_path": str(target_file), "backup_path": str(backup_file), "dry_run": dry_run } if not dry_run: pre_rollback_backup = target_file.parent / f"{target_file.name}.pre-rollback-{datetime.now().strftime('%Y%m%d-%H%M%S')}" if target_file.exists(): shutil.copy2(target_file, pre_rollback_backup) result["pre_rollback_backup"] = str(pre_rollback_backup) shutil.copy2(backup_file, target_file) result["restored_from"] = str(backup_file) ``` The receipt-based path also trusts externally supplied artifact paths: ```python execution_path = receipt.get("truth_anchor", {}).get("execution_path") execution = read_json(Path(execution_path)) result = execution.get("result", {}) rollback_pointer = result.get("rollback_pointer", {}) backup_path = rollback_pointer.get("backup_path") target_path = rollback_pointer.get("target_path") backup_file = Path(backup_path) target_file = Path(target_path) ... shutil.copy2(backup_file, target_file) ``` ### Technical Analysis The direct rollback interface accepts arbitrary `--backup` and `--target` paths. When `--execute` is supplied, `shutil.copy2()` copies the source to the destination without verifying that either path belongs to an authorized backup or project directory. Receipt-based rol ...[truncated 2438 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/execute.py:187
Finding: State-Root Escape Through Unvalidated Run and Candidate Identifiers
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The wording suggests broad apply/execute functionality and preview support, but the material mainly evidences rollback-related logic and artifact-driven restoration details. This is a real security concern because users may invoke the skill expecting safe preview semantics while the actual workflow performs state-changing operations or lacks the represented protections.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The wording suggests broad apply/execute functionality and preview support, but the material mainly evidences rollback-related logic and artifact-driven restoration details. This is a real security concern because users may invoke the skill expecting safe preview semantics while the actual workflow performs state-changing operations or lacks the represented protections.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The wording suggests broad apply/execute functionality and preview support, but the material mainly evidences rollback-related logic and artifact-driven restoration details. This is a real security concern because users may invoke the skill expecting safe preview semantics while the actual workflow performs state-changing operations or lacks the represented protections.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The wording suggests broad apply/execute functionality and preview support, but the material mainly evidences rollback-related logic and artifact-driven restoration details. This is a real security concern because users may invoke the skill expecting safe preview semantics while the actual workflow performs state-changing operations or lacks the represented protections.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill describes file read/write and environment-related capabilities but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent platform, an undeclared write-capable skill can be invoked with broader authority than reviewers or routing logic expect, increasing the chance of unauthorized file modification or misuse.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger phrase "execute candidate" is broad enough to match ordinary requests about running a candidate, not necessarily this file-modifying skill. Because the skill can write files, ambiguous invocation phrases raise the risk of accidental activation by an agent router and unintended modification of project content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger "回滚" is extremely broad and likely to collide with many unrelated rollback requests. In the context of a skill that can modify files and restore backups, accidental routing on such a generic phrase could revert changes outside the intended workflow or cause disruptive state changes.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says this skill is used to apply approved improvements, roll back previous changes, or preview change effects, and lists four supported actions. In code, ACTION_HANDLERS only implement direct file-modifying operations, while rollback is merely recorded as a pointer in the output artifact and no preview mode exists; unsupported actions are rejected instead.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes four actions using the names append, replace, insert_before, and update_yaml, suggesting a stable public action interface. The code instead accepts append_markdown_section, replace_markdown_section, insert_before_section, and update_yaml_frontmatter, narrowing behavior to markdown/frontmatter-specific operations and mismatching the documented action contract.
Content: No source excerpt is available for this finding.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 86% confidence
Finding: A one-word trigger like "回滚" is too short for safe routing and can match many benign user requests. While lower severity than a direct code flaw, it still increases the chance of unintended invocation of a state-changing skill, especially in multilingual or loosely matched routing systems.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The top-level docstring says this file is an 'Executor for low-risk generic-skill candidates,' which does not match the surrounding manifest context for an improvement executor that applies approved improvements, supports rollback semantics, and is not for scoring or gating. This is not merely incomplete documentation; it describes a materially different intent and scope.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The CLI help says rollback will create backups named like pre-rollback-*.bak, which communicates a specific artifact format to operators. However, the implementation at L140 and L183 names files as <target>.pre-rollback-<timestamp> without the .bak suffix, so the inline documentation contradicts actual behavior.
Content: No source excerpt is available for this finding.