Security audit

euthyna

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent security-audit skill, but it asks agents to run target repository tests and proof-of-concept commands without requiring sandboxing or explicit user approval.

Install only if you are comfortable using it for security audits and can run any target-repository tests or PoCs inside a disposable, secret-free sandbox. Review commands before execution and choose an explicit report output path.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: references/fact-producers.md:158
Finding: Static audit workflow executes untrusted target-repository code without isolation## Vulnerability Details **File Location**: `references/fact-producers.md:158-165` **Additional Locations**: `references/change-audit.md:120-126`, `references/verification-gates.md:249-268`, `SKILL.md:189-197` **Vulnerability Type**: Execution of untrusted repository code in the auditor's environment **Risk Level**: High ### Vulnerable Instructions `references/fact-producers.md:158-165` instructs the agent to execute tests from the repository under audit: ```powershell uv run --with coverage python -m coverage run ` --include="*/src/<package>/<file>.py" ` -m pytest <test-file> -o addopts="" -p no:randomly uv run --with coverage python -m coverage json -o <output-path>.json ``` `SKILL.md:189-197` additionally instructs the agent to verify reproduction commands from the audit report: ```powershell node <euthyna repository>/bin/euthyna.js gate <report-file> # Re-run each reproduction command for verification: node <euthyna repository>/bin/euthyna.js gate <report-file> --verify --cwd <audited-repository> ``` `references/verification-gates.md:249-268` requires executable proof-of-concept validation and real execution output when feasible. ### Technical Analysis A repository submitted for security review is an untrusted input. Its author can control test modules, imported packages, module initialization code, pytest configuration, local pytest plugins, test fixtures, and proof-of-concept scripts. Running `pytest` is not a passive inspection operation. Python code can execute during test collection, plugin loading, module import, fixture initialization, and test execution. Similarly, re-running a reproduction command such as `node tools/poc.js` executes repository-controlled code. Restricting command invocation to an argument array or an allowed executable does not make the referenced script trustworthy. The documented workflow does not require an ephemer ...[truncated 2159 chars]
Remediation: ## Remediation Suggestions 1. Keep static auditing non-executing by default. Treat test execution and proof-of-concept execution as separate dynamic-analysis operations. 2. Require explicit user approval before running any code supplied by the repository under audit. 3. Execute target-controlled code only in an ephemeral sandbox, container, or virtual machine configured with: - An unprivileged identity. - No inherited environment secrets or host credentials. - A read-only mount of the target repository. - A separate, disposable writable output directory. - Disabled networking by default, with narrowly allowlisted access when necessary. - CPU, memory, process, and execution-time limits. - No host socket, device, home-directory, SSH-agent, or package-manager credential mounts. 4. Review every reproduction command and referenced script before execution. Do not assume that an executable allowlist makes script arguments safe. 5. Make `gate --verify` refuse to run unless an explicit sandbox configuration and opt-in confirmation are present. 6. Prefer parsing coverage artifacts already supplied by a trusted CI environment. If no trustworthy coverage artifact exists, record the criterion as not evaluated rather than executing untrusted tests on the host. 7. Document the execution trust boundary prominently in `SKILL.md` and the verification guides.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The entire skill file is written in Chinese and provides no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The entire skill file is written as mandatory Chinese-language operational guidance, including prescriptive reporting style rules, but it does not state that the skill is region-specific or that users may choose another language. This can violate language/locale policy when a skill implicitly constrains interaction language without opt-in.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This markdown file contains user-facing instructional content exclusively in Chinese, including the title and all operational guidance. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The document title and the entire operating manual are written in Chinese, with no indication that other languages are supported or that the user can choose a locale. This creates a natural-language policy risk because it effectively imposes a specific language on users without opt-in or justification.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The markdown explicitly defines activation phrases as "这是真的吗", "验证这个发现", and "是否可利用", but these are generic conversational phrases that can easily appear in ordinary discussion. The file does not provide limiting context, explicit invocation boundaries, or negative examples to distinguish when the skill should versus should not activate.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The skill instructs the agent to write an audit report file and even specifies fallback locations such as the working directory, desktop, and temporary directory, but it does not require prior user confirmation before modifying the filesystem. This can cause unexpected local side effects, especially in environments where users expect analysis-only behavior or where writing to sensitive/shared paths is undesirable.

Natural-Language Policy Violations

Low

Confidence: 89% confidence
Finding: This markdown file is entirely written in Chinese and provides operational guidance without any indication that other languages are supported or that the language choice is optional. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified.

Static analysis

No suspicious patterns detected.