T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:55- Finding
Unvalidated External Feedback Can Influence Persistent Agent Memory and Workflows
- Content
View full analysis
- Remediation
View remediation
Security audit
PR Advocacy
Security checks for vulnerabilities and agentic risk
Overview
The skill is meant to manage PR reviews, but it asks the agent to autonomously change branches, commit work, and write persistent memory/state without clear user approval.
Install only if you are comfortable with an agent actively monitoring PRs and making repository changes. Before use, constrain it to specific repositories and PRs, require approval before commits or pushes, store tracking state in a user-approved skill-specific location, and disable automatic updates to core memory, skills, or workflows.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:35- Finding
Reviewer-Controlled Content Can Trigger Autonomous Code Changes and Commits
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:64- Finding
Hard-Coded Cross-Workspace Path Violates Filesystem and Repository Boundaries
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md - **Remove from active tracking list** - **Add to merged records** for success tracking - **Celebrate the contribution!** - **Update skills and workflows** based on successful patterns ## Real-time Tracking List Synchronization
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to automatically commit changes to the PR branch in response to reviewer feedback, but it does not require explicit user confirmation before modifying repository state. In the context of an autonomous agent skill, silent commits can cause unintended code changes, commit sensitive data, or alter a branch in ways the user did not authorize.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill mandates immediate persistence to a fixed local file path under the user's home directory and continuous synchronization after PR state changes, without clear consent or scope restrictions. This creates a risk of unauthorized local data modification, state corruption, or overwriting user-maintained files, especially under concurrent or repeated execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description states the skill will 'actively monitor, respond to, and drive Pull Request reviews to completion with real-time tracking list synchronization,' which implies broad, ongoing automation and action-taking without specifying clear activation boundaries, user consent, or scope limits. In an agent ecosystem, this can cause the skill to be invoked too broadly or granted implicit authority to act on repositories and review workflows beyond a narrowly defined user request.
- Content