Security audit

euthyna

Security checks for vulnerabilities and agentic risk

Overview

This code-audit guide includes user approval safeguards, with practical precautions needed for running tests and saving sensitive reports.

Review the separately obtained CLI before using it. Approve exact test and PoC commands, and run unfamiliar repositories in a disposable environment without sensitive credentials. Select a private report location because fallback desktop or temporary storage may have different access and retention settings. The absent CLI and design documents were not reviewed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

The coverage workflow instructs the agent to execute code from the audited repository without warning about the risks of running untrusted project code.

Medium

Category: Output Handling
Confidence: 95% confidence
Finding: The coverage workflow directs the agent to run tests from the repository under audit without requiring isolation or establishing that its code is trusted. Commands such as go test and pytest can execute attacker-controlled initialization, plugins, build hooks, or tests with the agent's permissions, exposing credentials and allowing filesystem modification. Auditing potentially hostile repositories makes this omission particularly dangerous, even though collecting coverage is a legitimate objective.
Content: No source excerpt is available for this finding.

Mandatory report saving falls back to desktop or temporary directories without warning about sensitive audit data being stored there.

Medium

Category: Output Handling
Confidence: 90% confidence
Finding: The workflow requires writing audit reports and automatically trying the working directory, desktop, and temporary directory if saving fails. It provides no privacy warning or approval step before placing potentially sensitive vulnerability findings in locations with different access, synchronization, or retention properties.
Content: No source excerpt is available for this finding.

The workflow requires executing vulnerability PoCs without warning about effects on user data or system integrity.

Medium

Category: Output Handling
Confidence: 94% confidence
Finding: The verification workflow expects executable PoCs to actually run and demonstrate impact, but does not require an isolated target, authorization, or limits on destructive effects. A PoC can execute commands, corrupt data, or affect services using the agent's ambient privileges; restricting which subagent may write files does not contain those runtime effects. Requiring evidence of exploitation makes containment especially important in this security-audit context.
Content: No source excerpt is available for this finding.