Rune

• Outcome: Review
• Latest audit: Aug 16, 2026 · 7:02 AM UTC
• Version: 2.32.0

Overview

This is a legitimate but very powerful coding-agent toolkit whose broad routing, persistence, external-tool use, and inconsistent read-only claims need human review before installation.

Install only if you want Rune to act as a broad coding-agent control layer. Before using it on sensitive repositories, require explicit confirmation for deployment, GitHub issue/PR comments, destructive git operations, external AI CLI dispatch, and any writes outside .rune. Review persisted .rune files periodically because they can influence future sessions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (134)

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill instructs the agent to prefer invoking a different-architecture external CLI for oracle-mode second opinions, which expands execution and data-exposure boundaries beyond a normal plan-analysis skill. Even though it includes some safety caveats, embedding cross-model/external-tool dispatch logic in this skill increases the chance of sensitive context being sent outside the current trust boundary or of unsafe tool chaining being normalized.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: This section lets a supposedly pre-implementation, read-only planning skill activate in debug/fix workflows and analyze live code files, contradicting its own scope. That kind of scope creep is dangerous because operators may trust the skill's limited role while it actually participates in production-adjacent diagnosis and cross-model escalation, increasing the chance of unintended data access, leakage, or unsafe actions in a higher-risk context.

Intent-Code Divergence

High

• Confidence: 94% confidence
• Finding: The scope guardrail claims the skill only reviews plans and never audits existing code, but the oracle-mode behavior explicitly performs code-file diagnosis. This mismatch can mislead integrators and users about what data the skill may inspect and what operational contexts it may enter, undermining security reviews and consent boundaries.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The skill declares itself a 'pure validator' with no outbound calls, but elsewhere instructs the agent to save decisions and progress to project files and the .rune directory. That mismatch can cause unexpected file writes during what should be a read-only validation step, expanding the skill's side effects and enabling unauthorized persistence of data or state.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The skill’s Output Format explicitly lists `generate` as a supported mode while the Constraints section later states the skill MUST operate in JUDGMENT mode only and must return `NOT_IMPLEMENTED` for `mode: generate`. This inconsistency can cause downstream callers, routers, or agents to invoke generation behavior that the skill is not designed to handle, creating unsafe improvisation risk and weakening control-flow guarantees in a coordination/orchestration skill.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The skill explicitly says debug must not change code, but later authorizes adding diagnostic instrumentation. That contradiction can cause an agent operating in 'read-only/investigation-only' mode to modify source files anyway, bypassing user expectations and any approval flow tied to non-mutating analysis.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The skill claims debug 'never changes files' while also instructing persistence to a knowledge-base file. This is a silent state-changing behavior that can write sensitive incident details, stack traces, or repo metadata to disk despite the contract that no files are changed.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill claims it is a pure utility with no outbound calls, but later defines campaign behavior that invokes other skills and performs code-changing actions. This mismatch can mislead higher-level orchestration, reviewers, or policy gates into treating the skill as read-only when it can actually modify the repository and trigger additional execution paths.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill instructs reading a user-level file from the home directory (`~/.claude/docs/design-dna.md`) as part of normal execution. Accessing user-scoped files expands the trust boundary beyond the project and can unintentionally ingest sensitive personal data, secrets, or hidden prompt content that influences downstream behavior. In this context the risk is elevated because the file is treated as a primary design authority rather than clearly untrusted input.

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: The skill expands from design-system generation into broad codebase accessibility auditing using grep-based searches across existing UI code. This increases data exposure and operational scope beyond what a design skill needs, potentially pulling in unrelated code, sensitive strings, or third-party content while normalizing overbroad repository inspection. The danger is contextual rather than code-execution-based: the skill gains unnecessary read reach and may produce findings from files the user did not intend to analyze under this task.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The skill claims it is a documentation-only utility, but its fallback workflow instructs the agent to run a local shell command (`npx repomix`) against a cloned repository. That mismatch weakens operator expectations and can lead to unintended command execution in contexts where the caller believed the skill was read-only, increasing the risk of executing untrusted tooling or repository-triggered behavior.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The MCP webhook example contradicts the file’s own guidance to acknowledge within 5 seconds and process asynchronously. Here, `handleWebhookEvent(event)` is placed in `waitUntil`, but the code still performs synchronous signature verification and JSON parsing first; more importantly, the static finding points out an immediate-response inconsistency in the example that can cause retries or duplicate delivery if processing grows beyond the webhook deadline in real adaptations.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The skill claims it never edits code, yet earlier instructions require saving decisions and progress to project files and the .rune directory. In an agentic environment, this contradiction can bypass operator expectations and cause unintended filesystem writes, which is dangerous because users or orchestrators may treat the skill as analysis-only while it persists data or alters repository state.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly claims to be 'pure validation (read-only scanning)' but elsewhere instructs the agent to save decisions and progress to project files and the .rune directory. That contradiction can cause unexpected writes during a security scan, weakening the trust boundary around an integrity-checking component and potentially persisting attacker-influenced content into the very state the skill is meant to validate.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The skill states that safeguard-generated characterization tests are never modified, but its rollback steps use broad git checkout commands over modified files. If those files include safeguard-created tests or if deletion/overwrite occurred during a surgery session, the rollback can silently alter or remove the very safety net the workflow depends on, undermining integrity and recovery guarantees.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The skill presents itself as read-only in self-validation, but its documented workflow explicitly writes JSON, markdown, and HTML artifacts into the workspace. This mismatch can mislead a user or orchestrator into authorizing the skill under stricter assumptions than it actually follows, reducing transparency around file-system side effects.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The skill's stated scope guardrail says it does not pull new reviews, yet earlier sections define issue-triage mode, inbox sweeping, and GitHub API interactions that can fetch and act on external review/issue data. This inconsistency can mislead operators and downstream agents about what actions are permitted, weakening trust boundaries and increasing the chance of unintended remote data access or workflow execution.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill is presented as a review capability, but its outbound calls include `test`, `fix`, and `sentinel`, and later sections instruct it to trigger remediation workflows. In an agentic environment, giving a review skill authority to initiate follow-on actions expands it from advisory analysis into autonomous orchestration, increasing the chance of unintended code changes or privilege misuse from a supposedly read-only entry point.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The file states that review 'does NOT fix anything,' but later instructions direct the agent to auto-fix findings and invoke `rune-fix.md`. This contradiction is dangerous because operators may trust the skill as non-mutating while it actually authorizes modifications, undermining least privilege and user consent expectations.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The chain metadata says `files_changed: []` and claims the review skill does not change files, yet the workflow elsewhere instructs it to apply auto-fixes through `rune-fix.md`. This creates a misleading audit trail: systems or humans relying on metadata may classify the skill as non-mutating even though it can trigger code changes.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The skill asserts that it 'doesn't do work itself,' yet its workflow explicitly instructs the agent to read local state files, scan directories, and persist data. That mismatch can mislead reviewers and operators about the skill's true authority and side effects, increasing the chance that intrusive file access or state mutation occurs without appropriate scrutiny.

Intent-Code Divergence

Low

• Confidence: 79% confidence
• Finding: The document establishes routing as mandatory before any response, but later introduces a user override that permits skipping routing entirely. This weakens the control boundary the skill is supposed to enforce and creates an easy policy-bypass path for requests that the router would otherwise constrain.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: `skill-router` is positioned as a universal meta-enforcement layer for every action, yet its reachable set includes high-impact capabilities such as deploy, code modification, persistent memory, and document processing without visible policy constraints. A broad router with no explicit narrowing, approvals, or trust-boundary checks increases the risk of unsafe auto-routing, privilege overreach, and prompt-triggered access to sensitive operations.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The README recommends invoking broad, generic skills for vague categories like 'any code task' and parallel work without defining scope boundaries, safety constraints, or exclusion criteria. In an agent-skill ecosystem, this can cause overbroad routing, unexpected tool/skill activation, and unsafe delegation paths that increase the chance of misuse or execution of higher-risk capabilities than the user intended.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The guidance "Use `rune:cook` for any code task" is an overly broad trigger that can cause the skill to activate in many unrelated coding contexts without clear boundaries or user intent checks. In a large mesh of interconnected skills, this increases the chance of unnecessary delegation, overreach, or chaining into more privileged or risky workflows than the user actually requested.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/rune-ext-ecommerce.md:463

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/rune-ext-mobile.md:126

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/rune-ext-zalo.md:1060

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/rune-sentinel.md:297

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: skills/rune-browser-pilot.md:154

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: skills/rune-ext-ai-ml.md:807

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: skills/rune-ext-chrome-ext.md:448

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: skills/rune-ext-zalo.md:431