Chief Feature Workflow

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:19 AM UTC
• Version: 1.0.2

Overview

This skill is purpose-aligned for automating Chief feature work, but it gives agents broad autonomous command, push, and PR authority without enough human review controls.

Review before installing. Use this only in repositories where you are comfortable with an agent running commands and publishing branches, and require manual approval for shell commands, generated diffs, pushes, PR creation, and any force cleanup. Avoid using untrusted project or PRD names unless they are validated as simple safe identifiers.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:45

Finding

Unvalidated and Unquoted User-Controlled Values in Shell Commands

Content

View full analysis

chief new ``` ```bash git worktree add ../- -b feat/ mkdir -p ../-/.chief/prds/ cp .chief/prds//prd.{md,json} ../-/.chief/prds// ``` ```bash cd ../- git add .chief/prds//prd.md git commit -m "docs: add PRD" ``` ```bash chief ``` ```bash git add .chief/prds//progress.md git commit -m "docs: add progress" git push -u origin feat/ ``` ```bash gh pr create \ --title "feat: " \ --body "Implements the PRD. See .chief/prds//prd.md for spec." \ --base main ``` ```bash cd git worktree remove ../- git branch -d feat/ ``` ### Technical Analysis The workflow instructs an agent to interpolate project names and PRD names directly into shell commands. These values are not validated, consistently quoted, or separated from command options with `--`. A malicious or malformed value containing shell metacharacters can change the structure of the generated command. Relevant characters include command separators such as `;`, command substitutions such as `$()`, redirection operators, whitespace, glob characters, and newline characters. Values beginning with `-` may also be interpreted as command-line options rather than names. The file-system commands additionally accept path components without preventing absolute paths or `..` traversal. Consequently, a crafted project or PRD name may cause operations to target directories outside the intended repository. The cleanup workflow increases the pot ...[truncated 2078 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:63

Finding

Blanket Approval of Autonomous Shell Commands Bypasses Least-Privilege Controls

Content

View full analysis

- - Run `chief ` with pty:true - Press `s` to start the loop - Approve bash prompts with `1` + Enter (or `2` to always allow) - If stuck on a prompt, send hex `0d` (Enter) - Poll until all stories show ✓ (100%) - Commit progress.md, push, open PR - Announce the PR URL when done ``` ```text - TUI bash prompts: use `1` (Yes) or `2` (Yes, always allow) - If stuck on a permission prompt, send `hex: ["0d"]` via `process(send-keys)` ``` ### Technical Analysis The Skill explicitly instructs a subagent to approve Bash permission prompts and recommends a persistent “always allow” response. It also advises sending an Enter key when blocked by a permission prompt. These instructions bypass a security boundary intended to ensure that potentially dangerous commands receive independent review. The implementation agent processes repository content and a PRD, either of which may be attacker-controlled or compromised. Agentic development tools can be influenced by instructions embedded in source files, documentation, tests, issue content, generated tool output, or build scripts. Automatically approving every Bash request converts such indirect influence into unrestricted local command execution. The workflow also instructs the subagent to commit, push, and open a pull request autonomously. This compounds the problem: malicious local changes may be propagated to a remote repository without a human reviewing the commands, generated diff, test behavior, or destination. ### Attack Path 1. An attacker places malicious instructions or executable behavior in a repository, PRD, ...[truncated 1990 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs a subagent to auto-approve bash prompts, continue when stuck, push changes, and open a PR autonomously. This removes human review from security-sensitive and repository-impacting steps, making it easy for unsafe commands, unintended edits, or exfiltration-capable operations embedded in the workflow to be approved automatically.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The workflow includes an unconditional git push as part of the normal path, and nearby instructions continue directly into PR creation. In the context of an AI-driven implementation loop, automatic remote publication can expose unreviewed code, secrets, or policy-violating changes to shared infrastructure without an explicit approval checkpoint.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

bash

git add .chief/prds/<prd-name>/progress.md
git commit -m "docs: add <prd-name> progress"
git push -u origin feat/<prd-name>

7. Open a PR

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough that this skill could activate on generic feature-request language and steer the agent into a high-impact workflow involving code changes, branch creation, and PR operations. In a skill that can run interactive tooling and initiate repository actions, overbroad activation materially increases the chance of unintended execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The cleanup note suggests using git worktree remove --force if there are uncommitted changes, which can destroy local work. Although presented as a convenience tip, it lacks a prominent warning or prerequisite backup/check step, so users may lose uncommitted data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.