Security audit

Pdlc

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it installs persistent agent instructions and bundled VS Code webviews with under-scoped scripting risks that should be reviewed before use.

Install only in a workspace where you are comfortable with persistent AI instruction files affecting future sessions. Use dry-run or manual install, review any AGENTS.md/CLAUDE.md/Copilot/Cursor/Kiro changes, avoid full-auto modes until you understand the generated file writes, and avoid the bundled dashboard extension until its webview uses safe data transfer, a restrictive CSP, and pinned or bundled JavaScript.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: ai-adlc/ai-adlc-rules/core-workflow.md:5
Finding: <![CDATA[Workflow precedence directives hijack agent behavior and broad user intents]]>
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: installer/install.sh:346
Finding: <![CDATA[Installer persists Skill-controlled instructions in platform auto-load files]]>
Content: View full analysis
&2 return 0 fi local rel; rel="$(orchestrator_dest "$platform")" local dest="$target/$rel" if [[ "$DRY_RUN" == true ]]; then echo -e " ${YELLOW}[DRY RUN] Would deploy orchestrator: session-orchestrator.md -> $rel${NC}" >&2 echo "$rel"; return 0 fi mkdir -p "$(dirname "$dest")" cp "$src" "$dest" step "Deployed session orchestrator -> $rel (the family's only always-loaded steering file)" >&2 echo "$rel" return 0 } ``` ```bash install_claude_entrypoint() { [[ "$1" == "claude-code" ]] || { echo ""; return 0; } [[ -n "$3" ]] || { echo ""; return 0; } local claude_md="$2/CLAUDE.md" import="@$3" local start_tag="" local end_tag="" if [[ -f "$claude_md" ]]; then if grep -qF "$import" "$claude_md"; then info "CLAUDE.md already imports the orchestrator - left unchanged" >&2 echo "exists" else printf '\n%s\n%s\n%s\n' "$start_tag" "$import" "$end_tag" >> "$claude_md" step "Appended AIFLC orchestrator import to existing CLAUDE.md" >&2 echo "appended" fi else printf '# Project Memory\n\n%s\n%s\n%s\n' "$start_tag" "$import" "$end_tag" > "$claude_md" step "Created root CLAUDE.md importing the orchestrator" >&2 echo "created" fi } ``` ### Technical Analysis The installer places the session orchest ...[truncated 1607 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: tools/extensions/AIFLC-PDLC-Dashboard/extension/src/extension.ts:19
Finding: <![CDATA[Workspace-controlled dashboard data is interpolated into an executable webview script]]>
Content: View full analysis
AIFLC Dashboard ${cssContent} `; } ``` ```ts const registryFiles = await vscode.workspace.findFiles( '**/data/REGISTRY.json', '{**/node_modules/**,**/templates/**,**/rule-details/**}', 5 ); // ... const parsed = JSON.parse(fs.readFileSync(candidate, 'utf-8')); const payload = (parsed && typeof parsed === 'object' && parsed.data) ? parsed.data : parsed; return { found: true, data: payload, message: '', expectedPath: candidate }; ``` ### Technical Analysis The extension reads dashboard data controlled by the opened workspace, serializes it with `JSON.stringify`, and inserts the resulting string directly into an executable HTML `
Remediation: View remediation
`. 4. Validate all dashboard input against the shipped JSON schema before rendering it. 5. Add a restrictive Content Security Policy using a per-render nonce: - `default-src 'none'` - `script-src 'nonce-...'` - `style-src 'nonce-...'` - only narrowly required image and font sources 6. Stop loading executable UI files discovered inside arbitrary workspace directories; package and load a trusted, extension-owned UI bundle. 7. Minimize accepted webview messages and validate every message field and path. 8. Add regression tests using payloads containing ``, HTML event handlers, malformed JSON, and unexpected registry paths. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

Location: tools/extensions/AIFLC-PDLC-Dashboard/extension/src/extension.ts:160
Finding: <![CDATA[Dashboard executes mutable third-party JavaScript from an unpinned CDN URL]]>
Content: View full analysis
``` The same remote script reference is embedded in the VS Code webview generated by `extension/src/extension.ts` and in the standalone demonstration page. ### Technical Analysis The dashboard retrieves and executes Mermaid at runtime from a CDN using the mutable major-version selector `@10`. The URL does not pin an exact release and does not provide a Subresource Integrity hash. Consequently, the JavaScript executed by the dashboard can change after the Skill has been reviewed. A compromised CDN, package publication, account, or mutable major-version artifact could supply different executable code. The risk is amplified because the script runs in a dashboard that renders local project, portfolio, backlog, architecture, and governance information. ### Attack Path 1. The user opens the standalone dashboard or VS Code dashboard while network access is available. 2. The page requests `mermaid.min.js` from jsDelivr. 3. A changed or compromised CDN/package artifact responds with attacker-controlled JavaScript. 4. The browser or webview executes that JavaScript in the dashboard context. 5. The malicious script gains access to dashboard DOM content and other data exposed to that context. ### Impact Assessment A successful supply-chain compromise can execute remote JavaScript in the dashboard context and read or alter locally rendered planning data. It can spoof dashboard output and attempt network disclosure subject to the host’s webview or browser controls. No evidence was found that the current Mermaid package is malicious; the vulnerability is the mutable, remotely executed dep ...[truncated 49 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (721)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · FAMILY_STRUCTURE.md (reported line 76)May include surrounding context.
md
| Marker | Meaning | |--------|---------| | `[gen]` | Tool-generated; re-derivation may overwrite (`ownership: generated`) | | `[hyb]` | Tool-seeded, team-edited; `` content preserved on re-derivation (`ownership: hybrid`) | | `[tool]` | Tool-owned, in a dedicated folder; not hand-edited | | `[marker]` | Chain detection anchor — name is non-negotiable |

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · INSTALL_GUIDE_CLAUDE.md (reported line 526)May include surrounding context.
md
**This means you can close Kiro and resume later.** When you start a new session and say "Continue AI-PILC", the AI reads the state file and picks up exactly where you left off. > **Important:** Don't delete state files unless you want to restart a workflow from scratch. ---

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · INSTALL_GUIDE_CODEX.md (reported line 509)May include surrounding context.
md
**This means you can close Kiro and resume later.** When you start a new session and say "Continue AI-PILC", the AI reads the state file and picks up exactly where you left off. > **Important:** Don't delete state files unless you want to restart a workflow from scratch. ---

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · INSTALL_GUIDE_KIRO.md (reported line 404)May include surrounding context.
md
**This means you can close Kiro and resume later.** When you start a new session and say "Continue AI-PILC", the AI reads the state file and picks up exactly where you left off. > **Important:** Don't delete state files unless you want to restart a workflow from scratch. ---

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · INSTALL_GUIDE_VSCODE.md (reported line 386)May include surrounding context.
After AI-GCE generates governance, create a governance instruction file:

markdown
 --- name: 'Governance enforcement' description: 'Checks compliance against workspace governance rules'

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · INSTALL_GUIDE_VSCODE.md (reported line 422)May include surrounding context.
You can create instructions that only activate when working in specific folders:

markdown
 --- name: 'AI-PILC detail loading' description: 'Loads AI-PILC phase details when working in PILC output folders'

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broad family of injectable workflow packages for guiding AI coding agents through the software delivery lifecycle. The supplied code does not implement those workflows. Instead, it provides a command-board UI inside VS Code that searches for local UI assets, loads trigger metadata, renders a webview, and copies trigger strings to the clipboard. This is a materially different primary purpose: a local extension for browsing/copying triggers rather than the workflow packages themselves. The clipboard access and workspace file scanning are also undeclared capabilities, though still consistent with the UI tool behavior. Overall, the description does not accurately represent this code chunk's actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a family of workflow packages for guiding AI coding agents through the software delivery lifecycle. The supplied code does not implement that lifecycle guidance directly; instead, it registers a VS Code command, opens a webview panel, loads CSS/JS/JSON assets, searches workspace directories for UI resources, and copies trigger keys to the clipboard on user action. This is a materially different primary purpose: a local command board UI for browsing/copying triggers, not the workflow packages themselves. The code also accesses workspace files and the clipboard, capabilities not reflected in the description.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
md
./installer/install.sh

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · ai-adlc/ai-adlc-rule-details/assembly/agent-installation.md (reported line 1)May include surrounding context.
md
 # Post-Workflow: Agent Installation ## Phase: 🚀 ASSEMBLY (post-workflow)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · ai-adlc/ai-adlc-rule-details/common/content-validation.md (reported line 91)May include surrounding context.
System(sys, "System", "Description") System_Ext(ext, "External", "Description") Rel(user, sys, "Uses", "HTTPS")

text

C4 validation rules:

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · ai-pilc/ai-pilc-rule-details/common/content-validation.md (reported line 128)May include surrounding context.
System(sys, "System", "Description") System_Ext(ext, "External", "Description") Rel(user, sys, "Uses", "HTTPS")

text

C4 validation rules:

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · ai-adlc/ai-adlc-rule-details/common/diagram-standards.md (reported line 1)May include surrounding context.
md
 # Diagram Standards ## Purpose

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · ai-adlc/ai-adlc-rule-details/decomposition/system-context.md (reported line 150)May include surrounding context.
md
**Direction:** - **Inbound** — External system sends data TO us (we consume) - **Outbound** — We send data TO external system (we produce) - **Bidirectional** — Both directions **Criticality:**

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · ai-adlc/ai-adlc-rule-details/design/component-design.md (reported line 1)May include surrounding context.
md
 # Component Design (C4 Level 3) ## Stage: 12 of 13

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · ai-adlc/ai-adlc-rule-details/foundation/workspace-detection.md (reported line 1)May include surrounding context.
md
 # Workspace Detection & Context Loading ## Stage: 1 of 13

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · ai-adlc/ai-adlc-rule-details/templates/agents/agent-guide.md (reported line 1)May include surrounding context.
md
 --- generatedBy: AI-ADLC generatedVersion: "{version}"

Scope Creep

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The manifest/tool declaration permits only read access via tools: ["read"]. Later instructions require appending compliance-log events to .governance/compliance-log/events/{today-date}.jsonl, which is a write operation outside the declared permission baseline.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · ai-adlc/ai-adlc-rule-details/templates/management-framework.md (reported line 1)May include surrounding context.
md
 # Management Framework — Consolidated Spine Template (AI-ADLC) | Field | Value |

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · ai-dfe/USER_GUIDE.md (reported line 55)May include surrounding context.
md
| `DAT__ status` | Report which data files are stale vs. their sources | | `DAT__ discover` | Force re-discovery (re-read every SOURCE_MAP + schema) | | `DAT__ validate` | Dry-run schema validation without writing | | `DAT__ cleanup --before {ms-timestamp}` | Delete history snapshots older than a timestamp | | `DAT__ master` / `DAT__ master --set {family}` | Report / set the master DFE (multi-family) | | `DFA__` | Run the quality agent — a report-only health check |

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The embedded installation rule states that when the user types DHC__ anywhere in a prompt, the agent should immediately execute with no further clarification. This is an ambiguous and overly broad trigger because it lacks negative examples or exclusions for mentions, pasted docs, or analysis of the shortcut itself, increasing unintended invocation risk.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This line states the engine overrides all other workflows not only for the explicit _DFE_ key but also whenever the user requests data gathering, shaping, distribution, or any DAT__/DFA__ operation. Terms like 'data gathering' and 'distribution' are generic and could collide with normal user intent, especially because they are tied to an override behavior.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · ai-dwg/USER_GUIDE.md (reported line 65)May include surrounding context.
md
### Delta Reconciliation Rules - Detects what changed in the AP since last generation - Preserves anything marked `` (team additions) - Updates only net-new or changed items - Never destroys team customizations - Produces a reconciliation report showing what was added/changed/preserved

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · ai-dwg/ai-dwg-rule-details/baseline/document-stamping.md (reported line 1)May include surrounding context.
md
 # Document Stamping & Obsolescence Protocol ## Purpose

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · ai-dwg/ai-dwg-rule-details/common/ap-reading-guide.md (reported line 1)May include surrounding context.
md
 # Peer Input Reading Guide ## Purpose

Static analysis

No suspicious patterns detected.