Security audit

AI Auto Dev

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed automation workflow, but it asks the agent to disable approvals, run with full filesystem access, persist cross-session logs, and push commits/tags to GitHub without user confirmation.

Install only if you are comfortable with a highly autonomous coding workflow. Before use, keep approval prompts enabled, avoid danger-full-access unless narrowly justified, remove the automatic GitHub push/tag step or require explicit review, and redirect persistent logs from ~/.claude to a project-local location with sensitive details minimized.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:24
Finding: Mandatory Approval Bypass and Unrestricted Sandbox Access
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:39
Finding: Session Trust Manipulation Intended to Avoid Later Confirmations
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:574
Finding: Automatic Commit, Tag, and GitHub Push Without User Confirmation
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:758
Finding: Cross-Session Agent State Writes and Mandatory Future Ingestion
Content: View full analysis
> ~/.claude/windtunnel/experiments/$(date '+%Y-%m-%d')-log.md << 'EOF' {experiment log content} EOF ``` The persisted content includes measurements, decisions, baseline comparisons, and lessons intended to affect future sessions. ### Technical Analysis This design creates a persistent, cross-session input channel. Data generated during one task is written under the Agent's home directory, and future sessions are required to consume related files as trusted context. If project-controlled content, Builder output, or generated summaries enter these files without strict validation, an attacker can store instruction-like text that survives the current task. A later Agent may interpret that text as authoritative memory, policy, or historical guidance. The risk is amplified because the files are outside the audited project and can influence unrelated future sessions. This is distinct from operating-system persistence: the Skill does not install a service or startup hook. The security issue is persistent Agent-memory influence. ### Attack Path 1. An attacker introduces instruction-like content through a repository file, task description, Builder output, or generated report. 2. The workflow incorporates the content into an experiment log, baseline, archive, or summary. 3. The content is written to persistent storage under `~/.claude/windtunnel`. 4. The current session ends. 5. A future session follows the mandatory recovery procedure and reads the per ...[truncated 836 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:18
Finding: Unpinned Global Third-Party Tool Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 99% confidence
Finding: The skill instructs configuration of ~/.codex/config.toml with ask_for_approval = "never" and sandbox_mode = "danger-full-access". This deliberately disables human approval checkpoints and grants unrestricted filesystem access, substantially increasing the impact of any prompt injection, tool misuse, destructive command, or unintended exfiltration performed by the automated workflow.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
关键要求：Builder 必须有完整文件系统访问权限，能执行 npx/node/tsc 等命令。

以 Codex 为例，~/.codex/config.toml 需配置：

toml
ask_for_approval = "never" sandbox_mode = "danger-full-access"

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill claims documentation should only be staged, but later mandates direct updates to project documentation and GitHub synchronization before delivery. This scope mismatch can cause the agent to make persistent repository changes that the user did not clearly authorize, increasing the risk of unintended modification or publication.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs automatic GitHub commit/tag/push with no user confirmation. Given the surrounding instructions to disable approvals and use full filesystem access, this can publish sensitive code, secrets, or erroneous changes to a remote repository without an interactive checkpoint.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Automatic commit, tag, and push functionality extends beyond code-generation orchestration into publication and source-control mutation. In the context of a skill already requiring ask_for_approval = "never" and danger-full-access, this greatly increases the blast radius by allowing autonomous exfiltration of work product and irreversible repository history changes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill states formal documents are read-only and only staging files may be written, but elsewhere requires direct updates to README, CHANGELOG, and persistent logs. This contradiction can mislead users about what the agent will modify, undermining informed consent and making unauthorized persistence more likely.
Content: No source excerpt is available for this finding.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 98% confidence
Finding: Appending to ~/.claude/windtunnel/experiments/... writes persistent data into a user-level agent configuration area outside the project. This creates cross-session state and a durable sink for potentially sensitive project information, and in combination with autonomous execution can silently alter the agent's broader operating context.
Content: Scanner excerpt · SKILL.md (reported line 803)May include surrounding context.
写入命令（PM 在第四步后执行）：

bash
cat >> ~/.claude/windtunnel/experiments/$(date '+%Y-%m-%d')-log.md << 'EOF' {上述格式内容} EOF

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction '使用英文编写 Spec' imposes a specific language choice as a rule because the builder 'understands English more precisely.' This is a locale/language policy issue because it does not offer the user a choice or document a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The workflow requires automatic writes to local staging files and other logs as part of execution, without clearly surfacing that user-provided task content may be persisted. This creates a retention path for potentially sensitive information and expands side effects beyond the immediate coding task.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill directs reads and writes under ~/.claude, creating persistent user-level state outside the project workspace. That broadens access from task execution to cross-project data retention, which can expose unrelated context, leak sensitive task details into long-lived logs, and violate least-privilege expectations.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly reads prior session/project files and appends detailed task inputs, outputs, and conclusions to persistent logs. In a coding assistant context, those logs can naturally capture sensitive user data, proprietary requirements, or security-relevant details, creating a durable disclosure and retention channel.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.