Security audit

Advanced Collab Protocol

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent multi-agent handoff protocol, but it asks agents to access private session history and system configuration too broadly.

Review this skill carefully before installing in any environment where agents can access private histories, broad configuration files, or real messaging channels. It would be safer if context were passed through task-scoped summaries, identity lookup used a narrow API or sanitized mapping, and outbound routing fields were validated against trusted task metadata.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:64
Finding: Unrestricted Retrieval of Private Agent Session History
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:54
Finding: System-Wide Configuration Read for Identity Resolution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:44
Finding: Unvalidated Routing Envelope Controls Outbound Cross-Channel Messages
Content: View full analysis
ReplyToUsername: (or the Human's unique username if they need the direct reply) ``` * **Receiver Must Extract**: When receiving a task privately, extract the `GroupId` and `ReplyToUsername`. Proactively invoke the `message` tool (`action="send"`, `target=""`) to broadcast your status to the group, explicitly mentioning the exact username provided (e.g., `[ACK] @ Instructions received.`). ``` ### Technical Analysis The receiver is required to extract `GroupId` and `ReplyToUsername` directly from an inter-agent message and use those values to construct an outbound `message` tool call. The protocol provides no validation that the supplied group belongs to the current task, that the receiver is authorized to contact it, or that the username is associated with the purported sender. This creates a confused-deputy condition: an untrusted or compromised upstream agent can supply attacker-selected routing values, while the receiving agent contributes its own `message` permissions. The issue is an insecure routing design because authorization decisions are based on payload fields rather than trusted session or platform metadata. ### Attack Path 1. A malicious or compromised upstream agent sends a ...[truncated 1281 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The protocol explicitly authorizes retrieval of upstream agents' thought process or private chat history when context is insufficient, which exceeds normal handoff needs and can expose sensitive internal reasoning, secrets, or private user data. In a multi-agent environment, this creates an unnecessary lateral data access path that could leak information across tasks, users, or trust boundaries.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Directing agents to retrieve upstream private history via natural-language instructions creates a practical data-leakage channel, because agents may disclose or act on sensitive content that was never intended for the downstream recipient. The surrounding skill context makes this more dangerous because it is a collaboration protocol for multi-agent handoffs, so the instruction is likely to be repeatedly exercised across many interactions and channels.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill presents a least-privilege tool list but later instructs agents to use sessions_history, creating a mismatch between documented permissions and actual behavior. This can lead operators to grant additional access ad hoc or deploy the skill with unclear security expectations, increasing the chance of over-privileged access to prior conversations.
Content: No source excerpt is available for this finding.