Security audit

copilot-team-scaffold

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AI workflow scaffold, but it sets up automatic hooks that read private session transcripts, inject local files into agent context, and create cross-project memory rules.

Review carefully before installing. This scaffold is not just a file generator: it installs automatic project hooks, reads prior Claude transcript files for catchup, injects recovered/context files into agent context, runs validation commands, writes learning logs, and asks to create global memories affecting future projects. Install only if you want that level of persistent workflow control, and consider removing transcript catchup and global memory creation first.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:429
Finding: Cross-Project Agent Memory Poisoning Through Global Behavioral Rules
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: templates/skills/planning-with-files/scripts/session-catchup.py:18
Finding: Unauthorized Reading and Injection of Private Claude Session Transcripts
Content: View full analysis
Path: """Convert project path to storage path format.""" sanitized = project_path.replace('/', '-') if not sanitized.startswith('-'): sanitized = '-' + sanitized sanitized = sanitized.replace('_', '-') return Path.home() / '.claude' / 'projects' / sanitized def get_sessions_sorted(project_dir: Path) -> List[Path]: """Get all session files sorted by modification time (newest first).""" sessions = list(project_dir.glob('*.jsonl')) main_sessions = [s for s in sessions if not s.name.startswith('agent-')] return sorted(main_sessions, key=lambda p: p.stat().st_mtime, reverse=True) def parse_session_messages(session_file: Path) -> List[Dict]: """Parse all messages from a session file, preserving order.""" messages = [] with open(session_file, 'r') as f: for line_num, line in enumerate(f): try: data = json.loads(line) data['_line_num'] = line_num messages.append(data) except json.JSONDecodeError: pass return messages ``` ```python def summarize_unsynced(messages: List[Dict]) -> str: """Create a summary of unsynced messages.""" if not messages: return "" lines = ["## Unsynced Context from Previous Session\n"] for msg in messages[-10:]: msg_type = msg.get('type', 'unknown') if msg_type == 'human': content = msg.get('message', {}).get('content', '') if isinstance(content, str) and content.strip(): lines.append(f"**User:** {content[:200]}") elif msg_type == 'assistant': content = msg ...[truncated 3586 chars]
Remediation: View remediation
/task_plan.md` - `docs/sessions//progress.md` - `docs/sessions//findings.md` 3. If transcript recovery remains available: - Disable it by default. - Require explicit user consent for each recovery. - Show the exact transcript path before reading it. - Require an explicit session identifier rather than selecting the newest file. - Redact credentials, tokens, private keys, and other secrets. - Limit extraction to structured planning metadata rather than raw messages. 4. Clearly label recovered transcript text as untrusted data and prohibit treating it as executable Agent instructions. 5. Apply strict file-size and message-count limits to avoid excessive context exposure. 6. Add tests proving that the script cannot read files outside an explicitly approved repository directory. ]]>

T01 · Skill Instruction Hijacking

Error

Location: templates/hooks/scripts/pre-tool-use.js:61
Finding: Prompt Injection Through Automatically Trusted Planning and Lessons Files
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: templates/hooks/scripts/subagent-stop.js:186
Finding: Automatic Execution of Unpinned Packages Through npx
Content: View full analysis
0) { try { execFileSync('npx', ['vitest', 'run', '--reporter=verbose', ...tsTestFiles], { encoding: 'utf8', timeout: 90000, windowsHide: true, cwd: 'frontend', stdio: ['pipe', 'pipe', 'pipe'], }); } catch (e) { const output = (e.stdout || '') + (e.stderr || ''); if (output.includes('FAIL') || output.includes('Error')) { errors.push(`**vitest failed:**\n\`\`\`\n${truncate(output, 800)}\n\`\`\``); } } } ``` A related invocation exists in `templates/hooks/post-tool-lint.js:47-52`: ```javascript execFileSync('npx', ['eslint', '--fix', filePath], { encoding: 'utf8', timeout: 10000, windowsHide: true, cwd: 'frontend', stdio: ['pipe', 'pipe', 'pipe'], }); ``` ### Technical Analysis The hook invokes package commands through `npx` without `--no-install`, an explicit package version, integrity verification, or an absolute path to a trusted local binary. When the expected executable is not present locally, `npx` may resolve and download a package from the configured npm registry. The command then executes package-supplied code with the current user's permissions. Registry configuration may also redirect resolution to an internal or attacker-controlled package source. The `tsc` executable name is particularly ambi ...[truncated 1976 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding indicates behavior beyond scaffolding, including reading prior conversation/session logs from user directories and summarizing unsynced context. Accessing historical session artifacts is privacy-sensitive and materially different from project initialization, making the mismatch dangerous because it could expose unrelated local data without clear disclosure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding indicates behavior beyond scaffolding, including reading prior conversation/session logs from user directories and summarizing unsynced context. Accessing historical session artifacts is privacy-sensitive and materially different from project initialization, making the mismatch dangerous because it could expose unrelated local data without clear disclosure.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.
md
- 禁止硬编码敏感信息 - 日志脱敏 - 输入验证 - .env 不入库 ## 配置管理 {{根据技术栈生成配置说明}}

Context Leakage

High

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The function explicitly extracts all human and assistant messages occurring after the last planning-file update, creating a cross-session context recovery mechanism that can leak information from previous work into a new session. In this skill's context, that is more dangerous because the scaffold is intended to automate multi-agent workflows, increasing the chance that recovered context is propagated into agent prompts, logs, or other files without review.
Content: Scanner excerpt · templates/skills/planning-with-files/scripts/session-catchup.py (reported line 77)May include surrounding context.
python
def extract_messages_after(messages: List[Dict], after_line: int) -> List[Dict]: """Extract conversation messages after a certain line number.""" result = [] for msg in messages: if msg['_line_num'] <= after_line:

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill scaffolds hooks, agents, prompts, and memory-related files but does not declare an explicit tool scope such as allowed-tools or permissions. In a skill that reads templates, writes repository files, and may interact with memory/state, missing tool restrictions weakens least-privilege controls and makes unintended capability expansion more likely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description and operational instructions are written as directives in Chinese, beginning with a Chinese-only task statement. There is no indication that the user may choose another language or locale, which can violate language/locale policy requirements for user-facing skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs the agent to ask users a fixed set of questions and provide confirmation text in Chinese only. Because these are direct user-facing interaction templates with no language choice or fallback, they impose a specific language on all users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill documentation is written in Chinese and does not indicate that users may choose another language or that the language restriction is required for a region-specific purpose. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file includes natural-language comments and later user-facing denial reasons in Chinese, indicating the skill communicates operational guidance in a single language. Under the policy, forcing a specific language without offering user choice is a locale/language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The reason strings returned in the hook output are user-visible enforcement messages, and they are written only in Chinese. This forces a specific language for operational feedback without any apparent opt-in or documented locale limitation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code initializes session state by creating the .github/session-logs directory and overwriting .agents-gate and .code-edits with empty contents. Although the behavior is commented in code, there is no confirmation prompt, user-facing log/print, or other disclosure visible to the user before these file writes occur.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The hook reads local repository files such as the active plan file or .github/skills/planning-with-files/SKILL.md and injects their contents into hook output as additionalContext. That creates an implicit data-flow from local files into the model context without user confirmation, which can expose sensitive project data, hidden instructions, or prompt-injection content stored in those files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The hook automatically writes to .github/lessons-learned.md whenever validation fails, without any explicit user consent, opt-out, or prominent disclosure at the time of execution. In a scaffolding skill that installs automation hooks into a repository, silent persistence can surprise users, alter tracked files, and leak sensitive error context or file paths into committed project artifacts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The operational instructions are written entirely in Chinese and present the workflow as applying in all sessions, but they do not offer any language or locale choice. This can constitute a natural-language policy issue because the skill appears to force a specific language without user opt-in or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructional content is written entirely in Chinese and presents the task-execution rules in that language without any indication that the user can choose another language or that the skill is intentionally region-specific. This creates a natural-language locale policy concern because it implicitly constrains interaction language without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains user-facing instructional content exclusively in Chinese, including the main heading and all guidance. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s user-facing natural language content is entirely in Chinese, including the title and operational descriptions, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking context. This creates a locale/language policy concern because it imposes a specific language by default.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description says to use the skill for 'complex multi-step tasks, research projects, or any task requiring >5 tool calls,' which is expansive and leaves room for subjective interpretation of what counts as complex or research-oriented. It does not provide exclusion conditions or negative examples to distinguish when the skill should not activate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The phrase 'Before ANY complex task' is a vague activation condition because 'complex' is undefined and may overlap with many normal user requests. Without concrete thresholds, examples, or exclusions, the skill may be invoked more often than intended.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The summarization function extracts plain-language content from prior human and assistant messages and includes up to 200 characters from each in output. This can expose credentials, personal data, proprietary code, or internal reasoning fragments present in session logs, especially because the skill is designed to run automatically at session start.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script reads prior session transcript data, derives a summary from user and assistant messages, and prints it directly to stdout with no consent prompt, redaction, or visibility control. In a SessionStart workflow, stdout may be surfaced to the agent or logs automatically, which can disclose sensitive data from previous conversations beyond the user's current intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This hook appends accessed or edited file paths to .github/session-logs/.agents-gate and .code-edits, which is a file-write operation affecting repository state. The code performs these writes silently with no confirmation prompt, logging, or explanatory comment aimed at the user about persistent logging behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The user-facing additionalContext strings include Chinese text alongside English, but the file does not indicate that output language is configurable or intentionally region-specific. This can violate language/locale policy expectations when users have not opted into a mixed-language experience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code file contains natural-language comments and documentation in Chinese, including the module description and function docstrings. Under the stated policy, forcing a specific language without user choice or a documented regional justification is a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file contains multiple Chinese comments and user-visible Chinese output strings such as '无', '最近…条验证教训', and '请在开发中重点关注上述类别，避免重犯。' This indicates the skill emits a fixed language/locale rather than offering a user choice or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.