Factory AI Droid

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:18 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent guide for Factory AI's Droid CLI, but it encourages powerful code, deployment, plugin, and auto-apply workflows without enough guardrails.

Install only if you trust the Factory AI Droid CLI and the providers/plugins you configure. Use reviewed branches or sandboxes, avoid --force for normal work, inspect diffs before commits or deployments, and verify MCP/plugin names and publishers before adding them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48
• Finding: Unverified MCP Server and Plugin Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 48–59 **Vulnerability Type**: Untrusted third-party component installation **Risk Level**: Medium ### Evidence ```bash ### MCP Servers ```bash droid mcp list # List installed MCP servers droid mcp add server-name # Add MCP server droid mcp remove server-name # Remove MCP server ``` ### Plugins ```bash droid plugin list # List plugins droid plugin add name # Add plugin ``` ``` ### Technical Analysis The skill recommends adding MCP servers and plugins using arbitrary names, but it does not define trusted registries, approved components, pinned versions, integrity checks, or signature-verification requirements. Plugins and MCP servers extend the capabilities of the external `droid` CLI. Depending on the component and its granted capabilities, an untrusted or compromised component could process project content, communicate with external services, invoke tools, or perform actions under the CLI user's account. Component resolution based only on an uncontrolled name also creates supply-chain risks such as typosquatting and dependency confusion. ### Attack Path 1. An attacker publishes, compromises, or recommends a malicious plugin or MCP server. 2. The attacker supplies a deceptive or typosquatted component name to the user or agent. 3. Following the documented workflow, the user or agent runs `droid plugin add name` or `droid mcp add server-name`. 4. The CLI installs or registers the component without the skill requiring provenance or integrity validation. 5. When invoked, the component operates with the capabilities and data access granted through the CLI. ### Impact Assessment The attainable privileges depend on the external CLI's component model and user configuration. Potential exposure includes source code, repository metadata, environment data available to the CLI, and credenti ...[truncated 278 chars]
• Remediation: ## Remediation Suggestions - Replace arbitrary component names with an explicit allowlist of reviewed MCP servers and plugins. - Pin every component to an approved immutable version or cryptographic digest. - Require signature, checksum, publisher, and registry verification before installation. - Require explicit human approval before adding or updating any external component. - Document the permissions, network destinations, and data-access requirements of each approved component. - Run third-party components in a sandbox with minimal filesystem, environment-variable, tool, and network access. - Periodically audit installed components and remove unused or unmaintained integrations.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43
• Finding: AI-Generated Changes Can Be Applied Without Confirmation## Vulnerability Details **File Location**: `SKILL.md`, line 43 **Vulnerability Type**: Unsafe automatic modification mode **Risk Level**: Medium ### Evidence ```bash droid exec --force "fix lint errors" # Auto-apply without confirmation ``` ### Technical Analysis The documented `--force` option explicitly allows an AI-driven external CLI to apply generated changes without confirmation. This removes a review boundary that would otherwise allow a user to inspect the proposed diff, detect unrelated changes, and reject unsafe output. Repository files, task descriptions, diagnostics, and other context supplied to an agent can contain misleading or adversarial instructions. If such content influences the generated action, automatic application can turn an incorrect or manipulated response into an immediate filesystem modification. The risk is amplified by the same document's examples involving Git operations and deployment, although the shown `--force` command itself only demonstrates automatic application of lint-related changes. ### Attack Path 1. An attacker introduces adversarial content into a repository file, issue description, diagnostic output, or other material processed by the external CLI. 2. The user or agent invokes the documented `droid exec --force` workflow. 3. The external model interprets the untrusted content and produces unintended or malicious modifications. 4. Because confirmation is disabled, the CLI applies those modifications before a human reviews them. 5. The altered files may subsequently be committed, built, tested, or deployed through normal project workflows. ### Impact Assessment Successful exploitation could modify, delete, or introduce files within the CLI's writable scope. This may cause source-code compromise, insertion of vulnerable behavior, corruption of configuration, test manipulation, or availability loss. If later Git or deployment steps are performed, the modifications could p ...[truncated 190 chars]
• Remediation: ## Remediation Suggestions - Remove the recommendation to use `--force` for ordinary engineering tasks. - Generate a patch or dry-run preview and require explicit human approval before applying changes. - Display the complete diff, including created, deleted, renamed, and binary files. - Restrict writable paths to the specific files required by the task. - Run the CLI in a disposable branch, worktree, container, or sandbox with least privilege. - Block access to credentials and deployment tooling during code-generation tasks unless explicitly required. - Require separate approvals for file modification, commit creation, remote pushes, and deployment. - Validate generated changes with tests, static analysis, and secret scanning before integration.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

External Model or Provider Selection

High

• Category: Excessive Agency

Content

```bash
droid exec --force "fix lint errors"    # Auto-apply without confirmation
droid exec --json "analyze code"        # JSON output
droid exec --model claude "task"        # Specify model
```

### MCP Servers

• Confidence: 90% confidence
• Finding: Allowing external model/provider selection can route code and task context to third-party LLM providers with different data handling, retention, and security properties. In this skill, the feature is presented without any guidance on approved providers, data classification, or privacy constraints, which creates a risk of inadvertent disclosure of sensitive source code or secrets.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Options for Exec
```bash
droid exec --force "fix lint errors"    # Auto-apply without confirmation
droid exec --json "analyze code"        # JSON output
droid exec --model claude "task"        # Specify model
```

• Confidence: 94% confidence
• Finding: The documented `droid exec --force` option explicitly enables automatic changes without confirmation, which is a form of autonomous decision-making over potentially sensitive repository state. In a skill consumed by an agent, this can bypass human oversight and lead to unintended code edits, configuration changes, or chained actions triggered by ambiguous prompts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents commands that can cause externally impactful changes, including deployment, PR creation, committing changes, plugin installation, and auto-apply behavior, but it does not include safety guidance, scope checks, or confirmation requirements. In an agent skill context, this increases the chance that a user or downstream agent will execute state-changing operations against code, infrastructure, or third-party services without understanding the consequences.

Static analysis

No suspicious patterns detected.