Security audit

Context Engineering (Koylan)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a context-engineering router, but it can load and follow mutable remote instructions from GitHub without pinning or integrity checks.

Install only if you are comfortable with the agent retrieving third-party instruction files from GitHub during use. Prefer a version that vendors the sub-skills locally or pins them to reviewed commit hashes; use least-privileged agent settings when trying it.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:29
Finding: Unpinned Remote Skill Instructions Are Retrieved and Followed
Content: View full analysis
/SKILL.md \`\`\` Example: For `context-optimization`, use: \`\`\` https://raw.githubusercontent.com/muratcankoylan/Agent-Skills-for-Context-Engineering/main/skills/context-optimization/SKILL.md \`\`\` ``` ```markdown ## How to Load a Sub-Skill 1. Identify the best-matching row above. 2. Check if the local sub-skill SKILL.md exists: \`\`\` references/context-engineering-skills/skills//SKILL.md \`\`\` - **If the file exists locally:** Read it directly. - **If the file does NOT exist** (e.g., submodule not initialized): Fetch from GitHub: \`\`\` https://raw.githubusercontent.com/muratcankoylan/Agent-Skills-for-Context-Engineering/main/skills//SKILL.md \`\`\` 3. Follow the instructions in that file. Most sub-skills have a `references/` directory with detailed patterns — read those files only when the relevant pattern is needed (progressive disclosure). 4. If the user's task spans two sub-skills (e.g., memory + multi-agent), read both SKILL.md files before responding. ``` ### Technical Analysis The Skill instructs the agent to retrieve external `SKILL.md` content from the mutable `main` branch of a third-party GitHub repository and then explicitly directs the agent to follow the retrieved instructions. The remote content is neither bundled with the audited package nor pinned to an immutable commit. No cryptographic digest, signature verification, content allowlist, or trust-boundary restriction is specified ...[truncated 2667 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README discloses remote GitHub fetching but does not prominently warn users that activating the skill may cause network access and ingestion of remote instructions. Lack of transparency matters here because the skill is not merely informational; it may dynamically import operational guidance from an external source, increasing privacy, trust, and integrity risks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation condition includes very broad language such as 'any discussion' of common agent architecture topics, making accidental triggering likely during ordinary conversations. Over-broad invocation increases exposure to the skill's remote-loading behavior and can cause unneeded instruction injection or context shifts when the user did not intend to use this capability.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Many trigger phrases are generic, such as 'implement memory' or 'start an LLM project', so the skill may activate in contexts where it is not actually needed. Because this skill routes to other instruction sources, accidental activation can unnecessarily expand authority and introduce unreviewed guidance into unrelated tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The catch-all activation language allows the skill to trigger on broad topics such as production agent architecture or multi-agent coordination, increasing the chance of unintended invocation. In this skill, overbroad triggering is riskier because activation can cascade into loading remote sub-skills and additional instructions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to fetch sub-skill instructions from GitHub at runtime, which creates a dynamic trust boundary outside the reviewed local repository. Even if the current file is benign, remote content can change, be tampered with, or differ from what was security-reviewed, enabling prompt injection or unsafe instruction updates.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Granting network access to retrieve remote skill documentation is broader capability than necessary for a routing skill and increases exposure to supply-chain and prompt-injection risks. The skill context makes this more dangerous because fetched SKILL.md content is intended to directly influence agent behavior.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
Example: For context-optimization, use:

text
https://raw.githubusercontent.com/muratcankoylan/Agent-Skills-for-Context-Engineering/main/skills/context-optimization/SKILL.md

Optional Enhancement (Offline Use):

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README states that sub-skill content is fetched directly from GitHub at runtime, which means the effective instructions executed by the skill are not fully pinned to the local package contents. That creates a supply-chain and prompt-injection surface: upstream repository changes, compromise, or malicious content in fetched documentation could alter agent behavior without local review.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Documented runtime network access to GitHub expands the skill's capabilities beyond static local guidance and introduces external dependency risk. Even if GitHub is a legitimate source, remote retrieval can expose the agent to unexpected behavior changes, outages, or adversarial content from the referenced repository.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.