Security audit

Workspace Init

Security checks for vulnerabilities and agentic risk

Overview

This workspace setup skill is not deceptive, but it needs review because it can run unpinned third-party code, change agent-facing workspace files, and install persistent repository hooks.

Install only if you intend this skill to make broad workspace changes. Review the repo list, generated CLAUDE.md, OpenSpec config, dependency install steps, and any template-update diff before allowing execution; avoid using untrusted repo URLs or free-form values supplied by someone else, and be aware that package installs and pre-commit hooks can run code from those repositories.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:51
Finding: Persistent Agent Instruction Injection Through Generated Configuration
Content: View full analysis
collected role - `[LEVEL: e.g., ...]` -> collected level - `[YOUR_LANGUAGE: e.g., ...]` -> collected language (appears twice) - `[YOUR_FORMAT_COMMAND]` -> confirmed formatter - `[YOUR_LINT_COMMAND]` -> confirmed linter - `[YOUR_TYPE_CHECK_COMMAND]` -> confirmed type checker - `[YOUR_TEST_COMMAND]` -> confirmed test runner - `[PROJECT_STYLE_GUIDE: e.g., ...]` -> style guide based on tech stack - Repository table in section 1 -> generated from repo list ``` ```markdown ### 3.2 Generate config.yaml Read `references/config-template.yaml` and populate it with: - `{project_name}` -> collected project name - `{description}` -> collected description - `{repos_list}` -> formatted repo list, one per line: ```text - **{name}**: {description} ``` Write the result to `openspec/config.yaml`. ``` ```markdown **CLAUDE.md** (partially customized): - Fetch the new template version - Extract the user's current filled values (role, level, language, commands, repo table) - Apply the new template structure - Re-fill the extracted values into the new template - Show the us ...[truncated 2544 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:78
Finding: Command Injection and Workspace Escape Through Unvalidated Project and Repository Names
Content: View full analysis
/dev/null || pip install -e . ``` ```bash cd repos/{name} # Use bun if bun.lockb exists, otherwise npm if [ -f bun.lockb ]; then bun install else npm install fi ``` ```markdown Generate `{project-name}.code-workspace`: ```json { "folders": [ { "path": ".", "name": "Config" }, { "path": "repos/{name1}", "name": "{Name1}" }, { "path": "repos/{name2}", "name": "{Name2}" } ] } ``` ``` ### Technical Analysis Repository names and project names are user-controlled and are reused as directory names, shell fragments, JSON values, and filenames. The instructions do not require validation, quoting, canonicalization, or a workspace-containment check. If an Agent follows the command templates by textual substitution, shell metacharacters in `{name}` can terminate or alter the `cd` command and introduce additional commands. Separately, names containing `../`, absolute path syntax, or path separators can cause generated paths to escape the intended `repos/` directory. Direct string interpolation into JSON can also produce malformed or attacker-modified `repos.json` and VSCode workspace configuration if quotation marks, backslashes, or control ...[truncated 1530 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:21
Finding: Execution of Unpinned and Unreviewed Third-Party Dependency Code
Content: View full analysis
/dev/null || pip install -e . ``` ```bash cd repos/{name} # Use bun if bun.lockb exists, otherwise npm if [ -f bun.lockb ]; then bun install else npm install fi ``` ```bash cd repos/{name} pre-commit install ``` ```markdown For each changed template file: **script/setup, .gitignore, .editorconfig** (non-customized files): - Fetch the new version and overwrite directly **CLAUDE.md** (partially customized): - Fetch the new template version - Extract the user's current filled values (role, level, language, commands, repo table) - Apply the new template structure - Re-fill the extracted values into the new template - Show the user a diff of structural changes for review ``` ### Technical Analysis The Skill installs the global `openspec` npm package without a pinned version or integrity constraint. It also clones user-selected repositories and runs package installation commands inside them. Python editable installation can invoke the repository's selected build backend. `npm install` and `bun install` can execute package lifecycle scripts. Installing pre-commit configuration creates executable Git hooks whose behavior is controlled by repository configuration. In addition, `./script/setup` is executed from the workspace template, and update mode can replace this script with content fetched from the mutable remote ` ...[truncated 1775 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill instructs the agent to read multiple local files such as CLAUDE.md, references/claude-md-fields.md, references/config-template.yaml, .workspace-init-version, and repository contents, but it does not declare an explicit tool scope like permissions or allowed-tools. In an agent environment, missing scope boundaries can lead to broader-than-expected file access and makes it harder for users or policy layers to constrain what the skill may read.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Broad trigger phrases like initialize and set up my project are generic and can cause this skill to activate in contexts unrelated to dev-config-template. Because the skill performs cloning, file writes, environment setup, and commits, accidental invocation can lead to unintended workspace changes and network activity.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
| Tool | Required | Install | |------|----------|---------| | git | Yes | Pre-installed on most systems | | jq | Yes | `brew install jq` (macOS) / `sudo apt install jq` (Ubuntu) | | openspec | Yes | `npm install -g openspec` | > Do NOT verify prerequisites on skill load. Check them at the start of

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 333)May include surrounding context.
md
| Tool | Required | Install | |------|----------|---------| | git | Yes | Pre-installed on most systems | | jq | Yes | `brew install jq` (macOS) / `sudo apt install jq` (Ubuntu) | | openspec | Yes | `npm install -g openspec` | > Do NOT verify prerequisites on skill load. Check them at the start of

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The When to Use section repeats broad trigger examples without adding clear scope checks, reinforcing the chance of over-triggering. In this skill's context, mistaken activation is more dangerous than usual because later phases perform automated repository cloning, dependency installation, and git commits without further prompts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The finalization step performs gh api calls to GitHub to retrieve the upstream template commit SHA, but the skill description frames the behavior mainly as local workspace initialization/update. Undisclosed network access is dangerous because it expands the trust boundary, may leak repository context or metadata, and can surprise users in restricted or compliance-sensitive environments.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Update mode fetches remote template state and diffs from GitHub using gh api, which goes beyond purely local workspace manipulation and introduces remote-content trust. This is risky because the skill may ingest and apply externally fetched changes into local files, enabling unintended modification if the remote source changes or the user did not expect network-backed updates.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.