Security audit
Security checks for vulnerabilities and agentic risk
This skill is not clearly malicious, but it needs Review because it uses risky install instructions and automatically stores sensitive prompts and raw model outputs in plaintext.
Before installing, review the setup path and avoid running the documented curl-to-bash command; prefer a package-manager or verified Bun install. Do not submit secrets, personal data, regulated data, or confidential business material unless you accept transmission to the configured LLM providers and automatic local plaintext retention. Check or delete intermediate/ and reports/ after use, and wait for the publisher to align package metadata and update dependency hygiene if provenance matters to your environment.
SKILL.md:49Unverified Remote Installer Is Piped Directly into a Shell
scripts/agent.ts:451Second-Order Prompt Injection Can Manipulate the Judge Evaluation
scripts/agent.ts:518Sensitive Queries and Raw LLM Responses Are Persisted in Plaintext
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Environment variables
.env
.env.local
.env.*.local
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Environment variables
.env
.env.local
.env.*.local
# Node.js
The skill is presented as a specialized devil's-advocate workflow, but the finding indicates it can act as a generic OpenRouter chat client and write debug output locally. That broader behavior can expose sensitive prompts, outputs, or metadata to third parties or disk without clear user expectation or consent.
The skill is presented as a specialized devil's-advocate workflow, but the finding indicates it can act as a generic OpenRouter chat client and write debug output locally. That broader behavior can expose sensitive prompts, outputs, or metadata to third parties or disk without clear user expectation or consent.
The skill is presented as a specialized devil's-advocate workflow, but the finding indicates it can act as a generic OpenRouter chat client and write debug output locally. That broader behavior can expose sensitive prompts, outputs, or metadata to third parties or disk without clear user expectation or consent.
The installation instructions tell users to fetch a remote script and execute it immediately via the shell. This bypasses normal review and integrity checks, so if the upstream server, CDN, or connection is compromised, arbitrary code runs on the user's machine.
curl -fsSL https://bun.sh/install | bash
Or on macOS with Homebrew:
The use of '| bash' is a classic command-chaining pattern that executes untrusted network content directly, turning a documentation snippet into an arbitrary-code-execution vector. In skill context, this is more dangerous because users may follow setup steps verbatim to enable the skill, increasing the chance of compromise during installation rather than during normal use.
curl -fsSL https://bun.sh/install | bash
Or on macOS with Homebrew:
axios is a runtime dependency and the lockfile pins version 1.13.6, which the finding reports as affected by multiple advisories including SSRF-related proxy bypass and prototype-pollution-adjacent issues. In a skill that orchestrates multiple LLMs and likely performs outbound network calls, a vulnerable HTTP client materially increases risk of server-side request forgery, credential leakage, redirect abuse, or unsafe request handling depending on how requests are constructed.
form-data 4.0.5 is a runtime dependency and the cited CRLF injection issue in multipart construction can enable request smuggling or header/body manipulation when attacker-controlled field names or filenames are included. If this skill uploads files or relays untrusted content to external services, the vulnerability could be used to tamper with outbound requests or bypass downstream security assumptions.
The dependency set includes axios at a version identified by the scanner as having multiple advisories, including SSRF-related and prototype-pollution-assisted man-in-the-middle/credential-theft scenarios. Because this skill is described as querying multiple LLMs in parallel and likely performs outbound HTTP requests, a vulnerable HTTP client is more dangerous in context: it may process attacker-influenced URLs, proxy settings, or responses, increasing the chance of credential leakage, SSRF, or response tampering.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
/**
* Devil's Advocate Agent
*
* Core implementation of the devil's advocate skill.
* Challenges ideas by generating strong counterarguments from multiple LLMs.
*/
import { readFileSync, mkdirSync, writeFileSync } from 'fs';
import { dirname, join } from 'path';
import { fileURLToPath } from 'url';
import { BailianClient, OpenRouterClient, OpenAICompliantClient } from './clients/index.js';
import type { ChatMessage, ChatCompletionResponse } from './clients/bailian.js';
/** Configuration file structure */
interface ConfigFile {
judge_model: string;
max_models: number;
max_tokens: number;
max_tokens_judge: number;
depth: string;
models: Record<string, {
provider: string;
model_id: string;
api_base: str
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
sanitized = sanitized.replace(/[\x00-\x08\x0B-\x0C\x0E-\x1F\x7F]/g, '');
const injectionPatterns = [
/ignore previous instructions/gi,
/system prompt/gi,
/you are now/gi,
/disregard/gi,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
* A reusable HTTP client for making requests to the OpenRouter API.
* Supports rate limiting, retries, and configurable timeouts.
*
* Environment variables are automatically loaded from .env file by Bun.
* See: https://bun.sh/docs/runtime/env
*/
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
* A reusable HTTP client for making requests to the OpenRouter API.
* Supports rate limiting, retries, and configurable timeouts.
*
* Environment variables are automatically loaded from .env file by Bun.
* See: https://bun.sh/docs/runtime/env
*/
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
* A reusable HTTP client for making requests to the OpenRouter API.
* Supports rate limiting, retries, and configurable timeouts.
*
* Environment variables are automatically loaded from .env file by Bun.
* See: https://bun.sh/docs/runtime/env
*/
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Examples:
bun run scripts/index.ts "What are the economic impacts of AI?"
bun run scripts/index.ts -m glm-5,gpt-5.4 "Explain quantum computing"
bun run scripts/index.ts -t financial "Will the Fed cut rates in 2026?"
bun run scripts/index.ts -t technical "How do I implement a distributed transaction?"
bun run scripts/index.ts --json "Latest AI breakthroughs"
The README explicitly instructs users to store live API keys in a project-root .env file but does not warn that such files must be excluded from version control, protected in local environments, and never shared. This creates a realistic secret-exposure risk through accidental commits, packaging, screenshots, support bundles, or multi-user development environments.
The skill declares environment variables and, per the static findings, relies on networked execution, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes the skill's external data access and secret usage less transparent to operators reviewing SKILL.md.
The skill routes user queries to multiple third-party LLM providers, yet the documentation does not warn users that their prompts may be transmitted externally. This is a privacy and compliance issue because users may provide confidential or regulated information without realizing it leaves the local environment and may reach multiple vendors.
The configuration routes prompts to external OpenRouter-hosted models and relies on an API key from the environment, which implies user data may be transmitted to third-party services. In a multi-model adversarial-analysis skill, prompts may contain sensitive business ideas, internal documents, or proprietary reasoning, so the lack of any explicit user-facing disclosure or consent mechanism creates a real data-exposure risk.
This manifest/config file sets the region to "cn" directly, which is a locale/region constraint expressed in natural-language-like configuration. There is no indication in this file that the user can opt into this locale or that the constraint is documented as justified for a region-specific deployment.
This JSON config sets "region": "cn", which imposes a specific locale/region behavior at the configuration level. Under the policy rules, forcing a specific language/locale or regional setting without opt-in or clear justification is a natural-language policy concern.
The manifest context says this skill is wei-devils-advocate, intended for adversarial multi-LLM idea stress-testing, but the lockfile's top-level package name is wei-research. That indicates the shipped code/dependency set belongs to a differently named skill, which is a concrete mismatch between declared identity/purpose and the actual packaged artifact.
The package metadata names and describes a different skill ('wei-research' / 'Multi-Model Researcher') than the provided manifest context ('wei-devils-advocate'). This mismatch can mislead reviewers, users, and automated tooling, and in a skill ecosystem it raises supply-chain and provenance concerns because the packaged artifact may not correspond to the declared skill.
The entire requirements file is written in Chinese and provides no indication that other languages are supported or that Chinese is an intentional, documented locale constraint. Under the language/locale policy rule, this can be a natural-language policy violation when a specific language is effectively forced without user opt-in or justification.
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal