Security audit

LEIO SDLC

Security checks for vulnerabilities and agentic risk

Overview

This SDLC automation skill can change, merge, clean up, and potentially publish code, and its control and cleanup paths need careful review before installation.

Install only if you want a highly automated agent pipeline to control development in a git repository. Review the exact repository, branch, notification channel, global run directory, and any GitHub sync integration first; do not use it where uncommitted or private code could be lost or published unexpectedly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:16
Finding: Host Agent Control and Dynamic Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/spawn_reviewer.py:86
Finding: Shell Command Injection in Reviewer Diff Generation
Content: View full analysis
{diff_file}" subprocess.run(diff_cmd, shell=True) baseline_file = os.path.join(args.run_dir, "baseline_commit.txt") if os.path.exists(baseline_file): with open(baseline_file, "r") as f: baseline_hash = f.read().strip() history_cmd = f"git log -p {baseline_hash}..HEAD > {os.path.join(args.run_dir, 'recent_history.diff')}" else: history_depth = max(5, pr_num) history_cmd = f"git log -n {history_depth} -p {args.diff_target} > {os.path.join(args.run_dir, 'recent_history.diff')}" subprocess.run(history_cmd, shell=True) ``` ### Technical Analysis The code constructs shell commands by directly interpolating: - `args.diff_target`, controlled through a CLI argument; - `args.run_dir`, also supplied through the CLI; - `baseline_hash`, read from an artifact file; - derived output paths. The commands are then passed to `subprocess.run(..., shell=True)`. Shell metacharacters, command substitutions, redirections, and separators in any interpolated value are interpreted by the operating system shell instead of being passed literally to Git. No revision validation, shell escaping, output-path containment check, or return-code enforcement is applied. ### Attack Path 1. An attacker gains control over an invocation argument or a run artifact. 2. The attacker supplies a malicious revision such as a value containing `;`, command substitution, or another shell operator. 3. `spawn_reviewer.py` incorporates that value into `diff_cmd` or `history_cmd`. 4. `shell=True` causes the injected shell syntax to be evaluated. 5. The injected command executes with the same operating-system privile ...[truncated 584 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/spawn_arbitrator.py:35
Finding: Shell Command Injection in Arbitrator Diff Generation
Content: View full analysis
{diff_file}" subprocess.run(diff_cmd, shell=True) ``` ### Technical Analysis Both `args.diff_target` and `args.run_dir` are inserted into a shell command without validation or quoting. Because the command is executed with `shell=True`, shell operators embedded in either argument are interpreted as commands. The use of shell output redirection is unnecessary and expands the attack surface. The implementation also omits `check=True`, so command failure or partial execution may go unnoticed. ### Attack Path 1. An attacker causes the arbitrator to be launched with a crafted `--diff-target` or `--run-dir`. 2. The crafted value includes a shell command separator or command substitution. 3. The value is interpolated into `diff_cmd`. 4. The operating-system shell evaluates the injected syntax. 5. The attacker's command runs under the arbitrator process's account. ### Impact Assessment Exploitation provides arbitrary command execution within the permissions of the user running the SDLC pipeline. The attacker may alter repository content, access readable local data, delete files, invoke external programs, or initiate network operations. ]]>
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: scripts/orchestrator.py:211
Finding: Automatic Execution of an Unverified External GitHub Synchronization Skill
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: deploy.sh:128
Finding: Persistent Git Hook Activation During Deployment
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (541)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Documenting git reset --hard, git clean -fd, and branch deletion as normal recovery behavior is dangerous because these are destructive operations that can irreversibly remove uncommitted work, generated artifacts, or unrelated local changes. In an autonomous agent skill, this is especially risky because retries, misclassification of a branch as 'toxic,' or prompt manipulation could trigger repository-wide data loss without operator intervention.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: git reset --hard is a high-risk command because it forcibly discards local modifications and, paired with git clean -fd, can wipe untracked files as well. Within this skill’s context, the danger is elevated: the document describes an automated state machine that may invoke this as part of failure handling, so a single bad decision, malformed input, or adversarial PR/task could cause immediate destructive loss of repository state.
Content: Scanner excerpt · ARCHITECTURE.md (reported line 36)May include surrounding context.
md
### 🟥 Red Path (死亡循环 / 熔断与降维重构) *触发条件：Yellow Path 连续失败 MAX_REVISIONS (默认 5 次)，或者 Coder 执行超时 (Timeout/Token Cap 触顶)。* 1. **Hard Abort (物理斩首)**: 引擎判定当前分支已被“剧毒污染 (Toxic Branch)”。立刻执行强杀。 2. **Tabula Rasa (恢复出厂设置)**: 执行 `git reset --hard` 和 `git clean -fd`，强制切换回 master，并**彻底删除**那个被污染的 feature 分支 (`git branch -D`)。 3. **Status Update**: 将该 PR 的状态改为 `status: blocked`。 4. **Adaptive Re-slicing (动态切片)**: - 引擎拿着失败日志，**定向拉起 Planner**。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes a strong claim that its only role is to launch orchestrator.py and mediate all code changes, but the analyzed behavior set indicates materially broader capabilities including filesystem mutation, git operations, testing, deployment, hook installation, external process execution, and possible service restarts. This kind of description-behavior mismatch is dangerous because it hides real privilege and impact from reviewers and users, increasing the chance that destructive or policy-bypassing actions are trusted and executed.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: docs/PRDs/PRD_043_CWD_Guardrail.md:32