Security audit

manifesto-hci

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent project-state purpose, but it automatically persists full conversations and Git-backed state with broad triggers and weak input scoping, so users should review it carefully before installing.

Install only if you explicitly want a local Git-backed project memory that records conversation history. Use a dedicated, non-sensitive project_id, avoid secrets in chats while it is active, review generated logs and commits, and do not use it in shared or untrusted conversations unless path validation, safe logging invocation, and consent controls are added.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:31
Finding: Session-Wide Agent Behavior and Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:38
Finding: Persistent Poisoning of Agent State with User-Controlled Constraints
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:47
Finding: Shell Command Injection Through Prescribed Message Logging
Content: View full analysis
user ""` and `python3 scripts/core.py log assistant ""`. ``` ### Technical Analysis The documented execution pattern inserts `project_id`, `user_message`, and `assistant_response` directly into a shell-shaped command. Quoting a value with double quotes does not safely neutralize shell syntax. For example, command substitutions remain active inside double quotes, and an embedded quotation mark can terminate the intended argument. The Python implementation uses an argument array when invoking Git, but that does not protect this documented logging operation if the Agent or host runtime executes the prescribed command through a shell. The vulnerable interpolation occurs before `core.py` receives its arguments. A malicious message can therefore contain shell metacharacters or command substitution syntax that the shell evaluates as code. ### Attack Path 1. An attacker sends a message containing shell syntax, such as command substitution or a quote followed by additional shell commands. 2. The Agent follows the Skill instruction and substitutes the raw message into the documented logging command. 3. The execution environment passes the constructed command to a shell. 4. The shell evaluates the injected syntax before launching `core.py`. 5. The injected command executes with the operating-system privileges of the Agent or Skill host. ### Impact Assessment Successful exploitation can provide arbitrary command execution under the account running the Agent. Depending on that account's permissions, an attacker may: - Read, modify, or delete ...[truncated 442 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/core.py:7
Finding: Path Traversal Through Unsanitized Project Identifiers
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (22)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes shell commands, Python scripts, git operations, and file writes, but declares no explicit tool scope or permission boundaries. That creates an authorization gap where an agent may perform filesystem and command execution beyond what users reasonably expect from an HCI/state-management skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation criteria are broad enough to trigger on common phrases like starting a project or managing state, increasing the chance the skill runs in contexts where the user did not intend persistent logging, git operations, or background auditing. This makes the dangerous behaviors more likely to be invoked accidentally.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to run python3 scripts/core.py, git init, and git commit as normal behavior, which elevates it from advisory workflow guidance into active code and shell execution. Because these actions operate on the local environment and repository state, they can modify files, create repos, and execute unreviewed local code with little user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Silent git init and initial commit create persistent local side effects without transparent notice or consent. Initializing a repository can alter user workflows, capture files into version control, and preserve sensitive data in commit history, making unintended disclosure and recovery difficult.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The required asynchronous sub-agent auditing and separate UI message pushing introduce hidden processing outside the main interaction channel. This can lead to unreviewed state mutations, unexpected disclosures, or deceptive UI behavior because the user may not see or approve the background actions that alter project state.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill mandates automatic logging of every user message and assistant response by executing a script, creating persistent records of potentially sensitive natural-language content. This exceeds what is necessary for a generic consensus workflow and can expose secrets, personal data, credentials, or proprietary information through local storage and downstream tooling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Automatic logging of both sides of the conversation occurs without any privacy notice, opt-in, or explanation of retention and access controls. In a long-term project skill, the captured content is especially likely to include strategic plans, code, credentials, or personal information, raising the severity of data retention and leakage risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Persistent logging of all user inputs and assistant responses creates a direct data retention and leak surface, especially because project conversations often contain confidential technical, personal, or business information. Combined with local script execution and git-backed persistence elsewhere in the skill, this significantly increases the chance of long-lived exposure, unintended sharing, or compromise of sensitive content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The prompt is written as a mandatory role definition in Chinese and explicitly instructs the agent to avoid any natural-language communication, which effectively fixes the skill's language/locale behavior without offering a user choice. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless clearly justified as region-specific, which is not stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instructions require every reply to begin with a Chinese tag and to maintain a specifically named Chinese checklist, which imposes a fixed language/locale behavior. The file does not offer an alternative language option or indicate that the Chinese-only format is optional or region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instructions require every reply to begin with a Chinese-formatted intent tag and to emit specific Chinese conflict text, which imposes a language/locale constraint on the assistant's responses. Because the file does not offer an opt-in, fallback, or language-selection mechanism, this is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The template hard-codes core section headings and operating guidance in Chinese, which can override or constrain the user's language preference without explicit consent. In a long-running state-management skill, this can degrade user comprehension, create incorrect consensus records, and increase the chance of misunderstandings being persisted as the authoritative project source of truth.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The specification directs the skill to perform silent git init and automatic commits during lifecycle operations without any explicit confirmation, warning, or rollback guidance to the user. Repository initialization and commit creation modify the user's filesystem and project history, so doing this implicitly can cause unintended state changes, pollute existing repos, or create audit/history artifacts the user did not knowingly authorize.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill hardcodes Chinese-language system and UI output, including lifecycle and status messages, without checking the user's language preference. While not directly enabling code execution or privilege abuse, this can impair user understanding of important consent, conflict, and state-change notifications, making the repository-writing behaviors harder to detect or challenge.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The background diff sub-agent is instructed to update manifesto files and run git commit automatically on turn completion, while only emitting post-hoc socket messages. Hidden asynchronous writes are dangerous because they can persist sensitive or incorrect data, create unintended commits, and alter project state outside the user's immediate awareness or approval.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/core.py (reported line 14)May include surrounding context.
python
def run_git(project_dir, args): try: subprocess.run(["git"] + args, cwd=project_dir, check=True, capture_output=True) return True except subprocess.CalledProcessError as e: print(f"Git error: {e.stderr.decode()}", file=sys.stderr)

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/core.py (reported line 32)May include surrounding context.
python
# Git init if not exists if not os.path.exists(os.path.join(project_dir, ".git")): subprocess.run(["git", "init"], cwd=project_dir, check=True) manifesto_path = os.path.join(state_dir, f"manifesto_{project_id}.md") if not os.path.exists(manifesto_path):

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated manifesto template is written with Chinese section headers and instructions, effectively imposing a specific language/locale on the skill output for all users. The file provides no user choice or documented justification for this locale constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill writes conversation history to a persistent JSONL log file without any disclosure, consent, retention control, or data-minimization safeguards. Because the logged content field stores arbitrary user and agent text, sensitive project data, secrets, or personal information may be silently retained and later exposed through local access, backups, or repository handling mistakes.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The log_event function persistently records full conversation content, creating a durable natural-language exfiltration and retention channel for any secrets, credentials, internal plans, or personal data mentioned during use. In this skill's context, which is designed for long-term project management and maintaining shared state, the probability of collecting high-value sensitive material is elevated, making the retention risk more significant.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prescribed system outputs are fixed in Chinese, and the file uses mandatory language such as 'Output:' for these messages without offering user language preference or opt-in. This is a natural-language locale constraint that can violate language-choice policy when the user has not selected Chinese.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file requires every foreground response to start with [意图同步: -m "Short summary"], imposing a Chinese label on all responses regardless of user preference. Because no language-choice mechanism or justification is provided, this is a locale-policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.