implement

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:58 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent implementation workflow, but it can automatically push code, open a draft PR, copy ignored environment files, and kill broadly matched dev-server processes without enough user control.

Install only if you want an agent to run a full implementation workflow that may create a worktree, commit changes, push a branch, and open a draft GitHub PR. Review the repo and branch before allowing remote actions, and avoid using it in projects where copying .env files or killing generic dev-server processes would be unacceptable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:124

Finding

Overbroad Cleanup Command Can Terminate Unrelated Development Servers

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 124-129
Vulnerability Type: Overbroad process termination
Risk Level: Medium

Vulnerable code:

markdown

- Dev server: `kill` the background task id, or `ps aux | grep -E "next.dev|vite|bun.*dev" | grep -v grep | awk '{print $2}' | xargs -r kill`
- Any other `run_in_background: true` tasks this skill started
- Do this proactively at end-of-flow; don't wait for the user to ask.

If the user is actively iterating (asking for follow-up edits in the same session), keep the server running — they'll want the preview. The trigger for cleanup is session boundary, not every tool call.

Technical Analysis

The fallback cleanup command searches the entire process list for generic command-line patterns associated with Next.js, Vite, and Bun development servers. It does not verify that matched processes were launched by this skill, belong to the active worktree, or correspond to the background task created during the current session.

Consequently, the command violates process ownership boundaries at the application level. Any user-owned process whose command line matches next.dev, vite, or bun.*dev can be selected and terminated. The pipeline also has a time-of-check/time-of-use weakness because process IDs are collected and later passed to kill without validating their identity immediately before termination.

Attack Path

1. A user starts an unrelated Next.js, Vite, or Bun development server.
2. The implementation skill starts another development server for its worktree.
3. The implementation flow reaches its cleanup stage.
4. Instead of terminating the recorded background task ID, the documented fallback command is executed.
5. ps aux returns both the skill-managed server and unrelated matching processes.
6. The generic regular expression selects all matching process IDs.
7. xargs -r kill sends a termination signal to every selecte ...[truncated 739 chars]

Remediation

View remediation

Remediation Suggestions

• Record the exact background task identifier and operating-system PID when the development server is started.
• Terminate only that recorded task or its verified process group.
• Remove the global ps aux | grep ... | xargs kill fallback.
• If PID-based recovery is necessary, store a PID file inside the isolated worktree and validate all of the following before sending a signal:
  • The PID is still active.
  • The process owner matches the current user.
  • The process start time matches the recorded process.
  • The process working directory resolves to the current worktree.
  • The command line matches the server command launched by this skill.
• Prefer graceful termination with a bounded timeout before escalating to a stronger signal.
• Report cleanup failure to the user rather than terminating processes that cannot be conclusively attributed to the current skill run.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation criteria include very broad natural-language phrases like 'ship it', 'drop this in', and 'go code it up', which can match ordinary conversation and trigger a high-impact workflow. In this skill, unintended invocation is more dangerous because the workflow creates worktrees, modifies code, commits, pushes to origin, and opens a draft PR automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill performs external side effects including git push and GitHub draft PR creation, but the description does not prominently warn that these actions happen automatically. That increases the chance a user invokes the skill without informed consent, leading to unintended publication of code, branch names, metadata, or incomplete work to remote services.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

- If the change involves a **non-trivial design choice**, sketch 2–3 options with tradeoffs in a few lines and let the user pick before proceeding (per the user's brainstorm-first preference).
- If scope feels too big for this lean flow — multi-subsystem, needs real architecture work — recommend `/worktree-dev:worktree-dev` and stop.

### 2. Create the worktree

Pick a descriptive branch name. Use repo convention prefixes (`fix/`, `add/`, `feat/`, `chore/`, `refactor/`, `perf/`) — check `git log --oneline -10` if unsure.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs copying gitignored files such as .env.local, .env.* and node_modules from another worktree into the new worktree. That expands the skill's access to sensitive local secrets and credentials beyond what is necessary to implement code changes, and could expose or propagate secrets into commands, dev servers, logs, commits, or PR-related tooling.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

L124 says background tasks should be cleaned up proactively at end-of-flow without waiting for user input, while L126 says to keep the server running during follow-up edits in the same session and use session boundary as the cleanup trigger. These instructions point to different cleanup moments and can mislead an agent about whether to terminate background processes immediately or preserve them for iteration.

Content

No source excerpt is available for this finding.