Ex-Coder

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:52 AM UTC
• Version: 1.1.4

Overview

The skill is a mostly coherent guide for using a powerful coding CLI, but it includes under-scoped examples that can grant broad remote control, filesystem, shell, and persistent configuration authority.

Review this skill before installing if you intend to use Ex-Coder with real repositories or credentials. Keep MCP filesystem roots project-scoped, avoid the / example, pin MCP packages instead of using unreviewed npx -y resolution, do not expose the HTTP API beyond trusted local access, prefer approval prompts over auto-approve, and do not let agents write user-provided values into shell startup files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:1277

Finding

Shell Command Injection Through User-Controlled Model Identifiers

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:1300

Finding

Persistent Command Injection Through Shell Profile Modification

Content

View full analysis

> ~/.zshrc`); ``` ### Technical Analysis The Skill embeds `userPreferredModel` in a shell command that appends content to `~/.zshrc`. The surrounding quoting is insufficient because a crafted value can contain quote characters, command substitutions, shell operators, or newlines. This creates two related risks: 1. The generated `echo` command can be altered when it is initially executed. 2. Attacker-controlled shell statements can be written to `~/.zshrc` and executed whenever a future interactive Zsh session starts. Modification of a shell startup file crosses the boundary from session-only configuration into persistent account-level behavior. ### Attack Path 1. An attacker provides a crafted preferred-model value. 2. The value is interpolated into the `Bash` template literal without validation or escaping. 3. The shell interprets injected syntax during the append operation, or attacker-controlled commands are written into `~/.zshrc`. 4. Any immediate injected command runs with the current user's privileges. 5. Commands persisted in `~/.zshrc` run again when the user starts subsequent Zsh sessions. ### Impact Assessment Exploitation can provide arbitrary code execution as the current user and persistence across agent runs and terminal sessions. An attacker may alter development tools, steal credentials exposed to future shells, modify PATH behavior, tamper with repositories, or install additional startup logic. The affected scope is the user's shell environment rather than only the audited project. ]]>

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:541

Finding

Automatic Execution of Unpinned MCP Packages Through npx

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:559

Finding

Excessive Root Filesystem Access Granted to an MCP Server

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (15)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 84% confidence

Finding

Exposing a memory purge command in an autonomous agent skill can be abused to delete stored context, auditability, or safety-relevant state. While memory management is a legitimate feature, presenting destructive memory operations without guardrails or warnings creates integrity and accountability risks.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

md

Command	Description
:memory stats	Show memory usage statistics
:memory inspect	Inspect memory contents
:memory purge	Purge memory cache
Taskfiles - :taskfile
Command	Description
:taskfile new	Create a new taskfile

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

A POST /message endpoint that sends messages to the agent is effectively a remote command surface. Without strong warnings and secure defaults, exposing this endpoint can let unauthorized parties drive the agent, potentially causing data disclosure, file modification, or command execution through downstream tool use.

Content

Scanner excerpt · SKILL.md (reported line 519)May include surrounding context.

md

GET	/session/turns	Session conversation
GET	/config	Configuration
GET	/events	SSE event stream
POST	/message	Send message to agent
Authentication:

export EXCODER_SERVER_PASSWORD=secret

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 606)May include surrounding context.

md

These commands install the latest released versions of **ex-coder-autonomy** (v3.0.0) and **scrapegoat-ex-coder** (v4.1.3).

**excoder-autonomy** (to run Excoder via :interactive command in Autonomy REPL. Note: it requires valid Anthropic API key in .env file)
**excoder-autonomy-goatmode** (opencode shell) Tip: To make agent live and breathe on the terminal use a conda environment with python 3.11 or higher

# Verify installation

Prompt Exfiltration via Tool

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains patterns that exfiltrate system prompts or internal instructions via tool calls (file writes, network requests, logging).

Content

Scanner excerpt · SKILL.md (reported line 1138)May include surrounding context.

md

How:

# Write instruction to file
echo "Implement feature X" > /tmp/task.md

# Run with stdin

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The interactive mode section advertises full file, shell, refactoring, and git capabilities without clearly warning that using the feature can execute commands and modify local data. In a skill consumed by agents, this omission increases the chance that users enable a high-privilege mode without understanding the operational risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs users how to expose an HTTP API with endpoints for session data, configuration, event streams, and message submission, but does not prominently warn that this creates a remote-control and data-exposure surface. If enabled insecurely or without strong authentication/binding, an attacker could access sensitive conversation content or issue agent commands remotely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The MCP examples include a GitHub token and broad filesystem access, including a sample that points the filesystem server at '/'. This can lead users to grant excessive local file access and embed credentials in configuration, creating a high risk of token leakage and broad unauthorized data exposure if the MCP server or connected agent is compromised.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill repeatedly states that Excoder must only be run through sub-agents and labels direct execution in the main context as a critical anti-pattern. However, this example executes excoder directly with Bash(...) rather than delegating through a sub-agent, contradicting the stated operational rule and potentially encouraging the forbidden usage pattern.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The same auto-approve behavior is correctly flagged twice from adjacent matching text. Automatic approval in a powerful coding agent environment creates a meaningful security risk because it permits autonomous execution without an explicit human checkpoint.

Content

Scanner excerpt · SKILL.md (reported line 1052)May include surrounding context.

md

--verbose / -v	Show log messages	Verbose in interactive
--debug / -d	Enable debug logging to file	Disabled
--port <port>	Proxy server port	Random (3000-9000)
--no-auto-approve	Require permission prompts	Auto-approve enabled
--dangerous	Disable sandbox	Disabled
--monitor	Proxy to real Anthropic API (debug)	Disabled
--force-update	Force refresh model cache	Auto (>2 days)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The same auto-approve behavior is correctly flagged twice from adjacent matching text. Automatic approval in a powerful coding agent environment creates a meaningful security risk because it permits autonomous execution without an explicit human checkpoint.

Content

Scanner excerpt · SKILL.md (reported line 1052)May include surrounding context.

md

--verbose / -v	Show log messages	Verbose in interactive
--debug / -d	Enable debug logging to file	Disabled
--port <port>	Proxy server port	Random (3000-9000)
--no-auto-approve	Require permission prompts	Auto-approve enabled
--dangerous	Disable sandbox	Disabled
--monitor	Proxy to real Anthropic API (debug)	Disabled
--force-update	Force refresh model cache	Auto (>2 days)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 1092)May include surrounding context.

md

Fix:

export OPENROUTER_API_KEY='sk-or-v1-...'
# Or add to ~/.zshrc or ~/.bashrc
Error 2: Excoder Not Installed
Error:

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Earlier sections explicitly say 'NEVER Run Excoder Directly in Main Conversation' and present await Bash("excoder ...") as wrong, yet this example uses await Bash(excoder --model ${model} --stdin < ${instructionFile}). This is an intent/documentation contradiction rather than mere incompleteness, because the file actively prescribes the opposite behavior elsewhere.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document's central rule is that Ex-Coder should always be used through sub-agents to avoid context pollution, but this implementation example directly shells out to excoder. Because the same file frames direct Bash execution as the primary mistake to avoid, this is a clear documentation-to-example divergence.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 1500)May include surrounding context.

md

Full README: mcp/excoder/README.md (in repository root)
AI Agent Guide: Print with excoder --help-ai
Model Integration: skills/excoder_usage/SKILL.md (in repository root)
External Links:

Excoder GitHub: https://github.com/ex-coder/ex-coder

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md

Manage long sessions with compaction and forking
Get code intelligence via LSP (diagnostics, symbols, definitions)
Remote control via HTTP API
Extend functionality with MCP servers
🆕 New Features Reference
Comprehensive Command Reference -
Chat Mode - type your goal, then follow-up prompts

Static analysis

No suspicious patterns detected.