ChatDev 2.0 Multi-Agent Team

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:34 AM UTC
• Version: 0.1.0

Overview

This skill is mostly transparent, but it gives an agent broad local ChatDev administration powers, including deleting workflows and overwriting executable local tool files.

Install only if you intentionally want an agent to administer a local ChatDev backend, not just run existing workflows. Before use, require explicit approval for upload, update, rename, copy, delete, output-directory moves, and especially any local tool create/overwrite action; avoid using the hot-update endpoint unless you have reviewed the exact filename and Python code and can roll it back.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:168

Finding

Arbitrary Local Tool Creation and Overwrite Enables Tool Hijacking

Content

View full analysis

dict:\n return {\"result\": a + b}\n", "overwrite": true }' ``` ``` ### Technical Analysis The Skill instructs the agent to submit arbitrary filenames and Python source code to a local API that creates or overwrites function-tool files. The explicit `"overwrite": true` option permits replacement of an existing tool rather than limiting the operation to creation of a new, uniquely named tool. This capability exceeds the Skill's primary declared purpose of invoking predefined ChatDev ability-unit workflows. Tool files are executable components: replacing a trusted tool can change the behavior of later legitimate-looking tool calls without changing the tool name presented to users or agents. This creates a tool-hijacking primitive and may provide indirect local code execution when the modified tool is subsequently loaded and invoked. Using `127.0.0.1` limits direct network exposure, but it does not remove the risk. The agent is explicitly instructed to act as a client for the privileged local endpoint. Exploitation depends on the ChatDev backend being reachable and accepting the documented operation. ### Attack Path 1. An attacker supplies or induces attacker-controlled Python source code and selects the filename of an existing trusted local tool. 2. The agent follows the Skill instructions ...[truncated 1221 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest frames the skill as a workflow invocation helper, but the body exposes a much broader administrative surface: reading raw workflow content, uploading new workflows, updating, renaming, copying, deleting, and hot-updating local tool code. This mismatch can mislead an agent into performing privileged mutating actions far beyond the user's likely intent, increasing the risk of unauthorized code/file changes and abuse of the local ChatDev backend.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill documents creating or overwriting local executable tool files via an API, which effectively enables code deployment into the local tool environment. Because this is unrelated to merely invoking workflows, it expands the skill into a code-modification primitive that could be abused to persist malicious logic, alter future tool behavior, or execute unintended operations through the backend.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

• URL: http://127.0.0.1:6400/api/workflows
• Example:

  text

  curl --noproxy 127.0.0.1 -v http://127.0.0.1:6400/api/workflows
  

2. Get ability unit raw content

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs moving the returned output directory into the working directory without clarifying what files may be moved, overwritten, or trusted. That creates unnecessary filesystem side effects and could introduce unreviewed artifacts into the agent workspace where later steps may consume them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation includes multiple mutating and destructive operations—upload, update, rename, copy, and delete of workflows—without any warning or approval step. In agent contexts, omission of impact warnings materially increases the chance of accidental or user-unintended state changes to local assets managed by the backend.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

• Format notes: same payload as upload (filename + YAML content string).
• Example:

  text

  curl --noproxy 127.0.0.1 -v -X PUT \
    http://127.0.0.1:6400/api/workflows/test.yaml/update \
    -H "Content-Type: application/json" \
    -d @- <<'EOF'
  

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

• Body: { "new_filename": "new_name.yaml" }
• Example:

  text

  curl --noproxy 127.0.0.1 -v -X POST \
    http://127.0.0.1:6400/api/workflows/test.yaml/rename \
    -H "Content-Type: application/json" \
    -d '{"new_filename":"renamed.yaml"}'
  

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The hot-update section shows how to create or overwrite executable tool files but provides no warning that it changes runnable code. In an agent setting, that omission lowers operator awareness and can normalize dangerous behavior such as silent code replacement or introduction of new execution capabilities.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.