AGI Farm

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:55 AM UTC
• Version: 1.2.0

Overview

This skill has a coherent multi-agent automation purpose, but it exposes powerful local workflow controls too broadly and installs or runs code in ways users should review carefully.

Install only if you are comfortable with a skill that creates agents, writes OpenClaw workspace files, registers recurring automation, may push a public GitHub repo, and runs a dashboard with powerful controls. Before use, bind the dashboard to localhost only, add authentication, remove wildcard CORS, avoid exposing port 8080, review GitHub export contents, pin or vendor the framework integrations, and update the dashboard dependencies.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: dashboard.py:518
• Finding: Unauthenticated Dashboard Exposes Sensitive Workspace and Agent Data<![CDATA[ ## Vulnerability Details **File Location**: `dashboard.py:518-594`, `dashboard.py:722-724`, `dashboard.py:1045` **Vulnerability Type**: Missing authentication, excessive data exposure, wildcard CORS, and network-wide binding **Risk Level**: High ### Vulnerable Code ```python return { "timestamp": now.isoformat(), "gateway_online": _probe_gateway(), "agents": agents, "tasks": tasks, "task_counts": task_counts, "sla_at_risk": sla_at_risk, "hitl_tasks": hitl_tasks, "okrs": okrs_raw if isinstance(okrs_raw, dict) else {}, "velocity": { "daily": velocity_daily, "weekly_summary": velocity_summary, "metrics": velocity_raw.get("metrics", {}) if isinstance(velocity_raw, dict) else {}, }, "budget": budget_raw if isinstance(budget_raw, dict) else {}, "projects": projects, "experiments": experiments, "backlog": backlog, "benchmarks": benchmarks_raw if isinstance(benchmarks_raw, dict) else {}, "knowledge": knowledge_entries, "knowledge_count": len(sk_entries), "memory_lines": memory_lines, "broadcast": broadcast[-2000:], "crons": crons, "dispatcher": dispatcher_raw if isinstance(dispatcher_raw, dict) else {}, "comms": comms, "sprint": sprint_raw if isinstance(sprint_raw, dict) else {}, "alerts": alerts, "cache_age_seconds": round(_slow_cache.age_seconds()), } ``` ```python def send_cors(self): self.send_header("Access-Control-Allow-Origin", "*") self.send_header("Access-Control-Allow-Methods", "GET, POST, OPTIONS") self.send_header("Access-Control-Allow-Headers", "Content-Type") ``` ```python handler = make_handler(workspace, broadcaster) server = ThreadingHTTPServer(("", args.port), handler) ``` ### Technical Analysis The dashboard server binds to all available interfaces by passing an empty ...[truncated 1951 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind the dashboard to loopback by default: ```python server = ThreadingHTTPServer(("127.0.0.1", args.port), handler) ``` 2. Require authentication for every API and SSE endpoint. Use a randomly generated bearer token or an authenticated session with secure, `HttpOnly`, and `SameSite` cookies. 3. Apply authorization separately to read-only data, task updates, HITL decisions, and cron administration. 4. Replace wildcard CORS with an explicit trusted origin. If the frontend is served from the same origin, omit CORS entirely. 5. Return only the minimum fields needed by each dashboard view. Do not return complete inboxes, outboxes, dispatcher history, or cron details by default. 6. Add a startup warning and require an explicit option such as `--listen-public` before accepting non-loopback connections. 7. Add access logging, rate limiting, and security tests that verify unauthenticated requests receive `401 Unauthorized` or `403 Forbidden`. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: dashboard.py:728
• Finding: Unauthenticated API Can Trigger Agent Jobs and Modify Persistent Workflow State<![CDATA[ ## Vulnerability Details **File Location**: `dashboard.py:728-844` **Vulnerability Type**: Missing authorization and CSRF protection on privileged operations **Risk Level**: Critical ### Vulnerable Code ```python def do_POST(self): path = self.path.split("?")[0] try: length = int(self.headers.get("Content-Length", 0)) body = json.loads(self.rfile.read(length)) if length else {} except Exception: body = {} def reply(data, status=200): b = json.dumps(data, default=str).encode("utf-8") self.send_response(status) self.send_header("Content-Type", "application/json") self.send_cors() self.send_header("Content-Length", str(len(b))) self.end_headers() self.wfile.write(b) # ── Cron trigger ── if path.startswith("/api/cron/") and path.endswith("/trigger"): cron_id = path.split("/")[3] try: subprocess.Popen(["openclaw", "cron", "run", cron_id], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) reply({"ok": True, "cron_id": cron_id, "action": "triggered"}) except Exception as e: reply({"ok": False, "error": str(e)}, 500) # ── Cron toggle enable/disable ── elif path.startswith("/api/cron/") and path.endswith("/toggle"): cron_id = path.split("/")[3] try: cron_file = Path.home() / ".openclaw/cron/jobs.json" jobs_data = json.loads(cron_file.read_text()) for j in jobs_data.get("jobs", []): if j["id"] == cron_id: j["enabled"] = not j.get("enabled", True) new_state = j["enabled"] break cron_file.write_text(json.dumps(jobs_data, indent=2)) reply({"ok": True, "cron_id": cron_id, "enabled": new_state}) broadcaster.broadcast(get_dashboard_data(workspace)) except Exception as e: reply ...[truncated 5299 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require strong authentication before processing any POST request. 2. Implement role-based authorization: - Read-only users must not trigger or toggle jobs. - Task managers may update only permitted task fields. - HITL approval must require a separately authorized human role. 3. Validate the `Origin` and `Host` headers and deploy CSRF protection for cookie-authenticated sessions. 4. Restrict CORS to the exact dashboard origin or remove it for same-origin deployment. 5. Enforce an allowlist of valid task states and a state-transition table. 6. Verify that task and cron IDs exist before returning success. 7. Require explicit confirmation or short-lived signed approval tokens for HITL decisions. 8. Replace direct `jobs.json` modification with a supported OpenClaw command or API that provides validation, locking, and audit records. 9. Add rate limits and idempotency controls to cron-trigger endpoints. 10. Record the authenticated actor, source address, requested action, and outcome in an append-only audit log. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: dashboard.py:865
• Finding: Stored Cross-Site Scripting Through Unsafe Inline JSON Injection<![CDATA[ ## Vulnerability Details **File Location**: `dashboard.py:865-870` **Vulnerability Type**: Stored cross-site scripting **Risk Level**: High ### Vulnerable Code ```python content = html_path.read_text(encoding="utf-8") # Fetch initial data payload and inject into HTML data_snapshot = get_dashboard_data(workspace) payload_json = json.dumps(data_snapshot, default=str) injection = f'<script>window.INITIAL_DATA = {payload_json};</script>' # Insert right before </head> if "</head>" in content: content = content.replace("</head>", f"{injection}\n</head>") ``` ### Technical Analysis The server serializes workspace data as JSON and inserts it directly into an executable `<script>` element. JSON string escaping is not sufficient for embedding untrusted values in HTML script context. A workspace value containing a sequence such as: ```html </script><script>/* attacker-controlled JavaScript */</script> ``` can terminate the intended script element because the HTML parser recognizes `</script>` before JavaScript or JSON parsing occurs. Potential attacker-controlled sources include task titles and descriptions, HITL notes, inboxes, outboxes, broadcasts, project data, and knowledge entries. This makes the issue stored XSS: the payload can be persisted in a watched workspace file and executed when an operator opens or refreshes the dashboard. ### Attack Path 1. An attacker, compromised agent, or untrusted task source writes a crafted string containing `</script>` and JavaScript into `TASKS.json`, an inbox/outbox, `broadcast.md`, or another dashboard data source. 2. The operator opens the dashboard. 3. `get_dashboard_data` includes the malicious string in `data_snapshot`. 4. `json.dumps` preserves the HTML-significant closing script sequence. 5. The server injects the serialized value into the page's `<head>`. 6. The browser terminates the original script element and executes the injected script in the dashboard origin. 7. The payload reads dashboard da ...[truncated 654 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer loading initial data through a same-origin request after the static HTML has loaded rather than injecting it into executable script text: ```javascript const response = await fetch('/api/data', { credentials: 'same-origin' }); const initialData = await response.json(); ``` 2. If server-side embedding is necessary, place data in a non-executable element: ```html <script id="initial-data" type="application/json">...</script> ``` 3. Before embedding JSON in HTML, escape at least `<`, `>`, `&`, U+2028, and U+2029. For example, replace `<` with `\u003c` so `</script>` cannot appear literally. 4. Add a restrictive Content Security Policy that disallows arbitrary inline scripts. Use script hashes or nonces if inline code is unavoidable. 5. Treat every workspace and agent-generated value as untrusted input. 6. Add regression tests using payloads containing closing script tags, HTML comments, Unicode separators, and malformed JSON. 7. Authenticate state-changing APIs so that an XSS defect does not automatically provide administrative workflow access. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:180
• Finding: Mutable Third-Party Repository Code Is Retrieved and Executed During Setup<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:180-188` **Vulnerability Type**: Unpinned remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash if [ ! -d ~/.openclaw/skills/<fw>-collab ]; then TMP=$(mktemp -d) git clone --depth 1 --filter=blob:none --sparse \ https://github.com/oabdelmaksoud/openclaw-skills.git "$TMP" cd "$TMP" && git sparse-checkout set <fw>-collab cp -r <fw>-collab ~/.openclaw/skills/ && rm -rf "$TMP" fi python3 ~/.openclaw/skills/<fw>-collab/build_agents.py --force 2>/dev/null || true ``` ### Technical Analysis The setup instructions clone the mutable default branch of an external Git repository, copy selected files into the user's persistent OpenClaw Skill directory, and execute `build_agents.py`. No commit SHA, signed tag, checksum, or content-signature verification is used. Consequently, the code executed during installation can differ from the version reviewed during this audit. Suppressing standard error and ignoring failure with `|| true` also reduces visibility into unexpected behavior. Although framework installation is related to the declared optional integration feature, executing mutable remote code is not the minimum-risk mechanism needed to provide that feature. ### Attack Path 1. The external repository, maintainer account, or default branch is compromised or receives an unsafe change. 2. A user selects AutoGen, CrewAI, or LangGraph integration during AGI Farm setup. 3. The setup clones the repository's current default branch. 4. The selected directory is copied into `~/.openclaw/skills/`. 5. Python executes the downloaded `build_agents.py --force` with the user's privileges. 6. The remote code can modify workspace files, install additional Skills, create persistence, access user-readable data, or run arbitrary local commands. ### Impact Assessment The retrieved Python program executes with the full privileges of the user running the setup. It can therefore ...[truncated 359 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the repository to a specific audited commit SHA: ```bash git clone --no-checkout https://github.com/oabdelmaksoud/openclaw-skills.git "$TMP" git -C "$TMP" checkout --detach <AUDITED_COMMIT_SHA> ``` 2. Verify the expected tree or archive using a published cryptographic checksum. 3. Prefer signed release artifacts or signed Git tags and verify signatures before execution. 4. Vendor the reviewed framework integration code in this package when licensing and maintenance requirements permit. 5. Display the repository URL, exact revision, requested destination, and command to the user before running it. 6. Remove `2>/dev/null || true`; report failures and preserve diagnostic output. 7. Execute framework setup with the least privileges possible and restrict write access to the intended Skill/workspace directories. 8. Re-audit and update the pinned revision through a controlled release process rather than tracking a mutable branch. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (75)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description presents a broad skill whose primary purpose is provisioning and managing a full OpenClaw multi-agent system, with many backend/bootstrap capabilities. However, the provided code chunk is only a frontend dashboard asset. It contains React DOM/runtime code and dashboard UI logic, including EventSource-based live updates and fallback polling, plus rendering of agent/task/alert/budget views. While this partially matches the dashboard portion of the description, it does not substantiate the core claimed capabilities such as one-command setup, environment bootstrapping, cron/dispatcher provisioning, export, or OS-level persistence. Therefore the supplied code materially underdelivers relative to the declared purpose and represents only a narrow subcomponent of the claimed skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a broad system for provisioning and managing a multi-agent AI team, with multiple operational commands and infrastructure automation. In contrast, this code chunk is a compiled/minified browser-side asset focused on rendering dashboard/chart components: legends, tooltips, layout calculations, responsive sizing, animation, and Redux-like state slices for chart layout and legend state. A dashboard is mentioned in the description, but this chunk only reflects generic UI/chart plumbing and does not substantiate the main claimed capabilities such as setup, rebuild, export, dispatch, communications, cron jobs, or agent orchestration. Therefore, the supplied code does not accurately represent the declared overall purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a broad system bootstrapper with operational automation and deployment/export features. The provided code chunk is instead a minified/compiled client-side dashboard bundle centered on rendering charts and handling UI interactions. It includes React/Recharts components for pie/line/bar charts, axes, labels, tooltips, event handling, and some domain-specific dashboard formatting helpers for statuses, risks, due dates, and markdown export text. Those behaviors align only with the 'dashboard' portion of the description, and even there the code shown does not demonstrate SSE/file-watcher/live push plumbing—only frontend rendering logic. Because the primary claimed capabilities (setup wizard, bootstrapping infrastructure, dispatch, cron, export bundle, LaunchAgent) are absent from this code chunk, the description does not accurately represent what this supplied code actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents the skill primarily as a comprehensive setup and management tool for building a multi-agent AI team, with many capabilities spanning provisioning, orchestration, exporting, and dashboarding. The actual code chunk is much narrower: it is only a frontend React hook supporting live dashboard updates via SSE with polling fallback and reconnection behavior. While the description does mention a React + SSE live ops dashboard, this code covers only that supporting dashboard behavior and none of the core claimed setup/bootstrap functionality. Therefore, the supplied code chunk does not accurately represent the broad declared purpose and is materially narrower in behavior than described.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description presents a broad interactive setup/bootstrapping skill whose primary purpose is to create and configure a full multi-agent AI team environment. The supplied code chunk does not implement that primary purpose. Instead, it implements only the dashboard portion: a local HTTP server with SSE live updates, filesystem watching, data aggregation from workspace JSON/Markdown files, and UI-serving behavior. Additionally, it includes mutable control actions not mentioned in the description for this chunk, such as triggering cron runs, toggling cron job enabled state by rewriting ~/.openclaw/cron/jobs.json, and updating task/HITL statuses in TASKS.json. While a dashboard is mentioned in the declared purpose, this code is materially narrower than the claimed setup wizard and also includes operational control capabilities that are not clearly declared. Therefore this chunk does not accurately match the declared description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The supplied code only performs local template rendering and file generation from team.json into a workspace. It does support part of the declared setup story: creating agent persona/docs files, shared comms folders/files, infrastructure documents, and a portable bundle. However, the declared description claims a much broader and more sophisticated skill: an interactive setup wizard, operational dashboard, dispatcher logic, cron jobs, LaunchAgent persistence, and several named commands. None of those capabilities appear in this code chunk. The code’s primary purpose is narrower: static scaffolding generation. Therefore the description materially overstates what the provided code actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents the skill as a broad interactive setup and management wizard for creating a complete multi-agent team environment. The supplied code, however, is only the auto-dispatch portion of that system. It does not perform setup, provisioning, dashboard creation, export, rebuild, or status functions. Instead, it operates on an existing workspace by reading TASKS.json/comms files, deciding which agents to trigger, notifying the orchestrator about HITL tasks, applying cooldown/backoff/dependency logic, and persisting dispatcher state. While auto-dispatch is mentioned in the description, this chunk alone materially under-delivers relative to the declared primary purpose and represents a different operational behavior than an interactive bootstrap wizard.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The supplied code chunk only implements cron registration for an existing OpenClaw team definition. It reads a team JSON file, derives a timezone, checks existing cron names, and invokes `openclaw cron add` to create several scheduled jobs. This is at best one small supporting part of the declared system ('cron jobs'), but it does not match the declared primary purpose of a comprehensive interactive setup wizard that bootstraps an entire multi-agent AI team with dashboards, dispatcher, bundle export, and command interface. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Chaining Abuse

High

• Category: Tool Misuse

Content

git clone --depth 1 --filter=blob:none --sparse \
    https://github.com/oabdelmaksoud/openclaw-skills.git "$TMP"
  cd "$TMP" && git sparse-checkout set <fw>-collab
  cp -r <fw>-collab ~/.openclaw/skills/ && rm -rf "$TMP"
fi
python3 ~/.openclaw/skills/<fw>-collab/build_agents.py --force 2>/dev/null || true
```

• Confidence: 94% confidence
• Finding: The framework installation step clones external code from GitHub, copies it into the skills directory, and then executes `build_agents.py` from that fetched content. This is a supply-chain risk: a compromised repository, branch, or transient network attack could lead to arbitrary code execution with the user's privileges.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Status
launchctl list | grep coopercorp
curl -s http://localhost:8080/api/data | python3 -m json.tool | head -5

# Restart
launchctl stop  ai.coopercorp.dashboard

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: brace-expansion 1.1.12 is affected by multiple DoS issues involving pathological expansion inputs that can hang or exhaust memory. Because this library is widely used in globbing and pattern parsing, a real vulnerability exists if any tooling path accepts attacker-controlled glob-like strings, even though in this project it is only a transitive dev dependency.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: browserslist 4.28.1 is directly present in the toolchain and the advisories describe crash/prototype write conditions and memory growth from untrusted stats or query results. This is a real vulnerable dependency, but the exploitability in this React dashboard lockfile is mostly constrained to developer/build contexts rather than the shipped browser app.

Known Vulnerable Dependency: flatted==3.3.3 — 2 advisory(ies): CVE-2026-32141 (flatted vulnerable to unbounded recursion DoS in parse() revive phase); CVE-2026-33228 (Prototype Pollution via parse() in NodeJS flatted)

High

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: flatted 3.3.3 has advisories for unbounded recursion DoS and prototype pollution during parse(). This is a real vulnerable dependency in the lockfile; while it is dev-only via caching/tooling paths, prototype pollution and parser abuse can still affect local automation or CI if untrusted serialized input is consumed.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: js-yaml 4.1.1 is affected by multiple CPU exhaustion issues from crafted YAML structures. This is a true vulnerable dependency and, even though dev-only, YAML parsers are commonly exercised in lint/config workflows where attacker-supplied config or content in a repository could trigger denial of service in CI or local tooling.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: nanoid 3.3.11 is reported vulnerable to infinite-loop and integer overflow edge cases in certain generator configurations. This appears to be a real dependency issue, but practical risk in this lockfile is limited because exploitation generally depends on specific API misuse with attacker-influenced size values and it is only transitively present through tooling.

Known Vulnerable Dependency: picomatch==4.0.3 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: picomatch 4.0.3 is affected by method-injection and ReDoS issues in glob matching. This is a real vulnerable dependency used in the Vite/globbing toolchain, and the danger increases if attacker-controlled file patterns or project contents are processed by the dashboard's development and rebuild workflows.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: postcss 8.5.6 has multiple advisories including arbitrary file read and XSS-related issues tied to attacker-controlled source maps or CSS output. This is a real vulnerable dependency in the frontend toolchain, and the skill context makes it more concerning because it ships a React dashboard and likely processes frontend assets during active dev-server use.

Known Vulnerable Dependency: vite==7.3.1 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: vite 7.3.1 is flagged for multiple arbitrary file read and path traversal issues in the development server. This is a true vulnerability and especially relevant here because the skill explicitly provides a React + SSE live ops dashboard, making dev-server usage central to the feature set; if exposed beyond localhost, an attacker could read files outside the intended project scope.

Hidden Instructions

High

• Category: Prompt Injection

Content

</head>
<body>

<!-- ── Header ─────────────────────────────────────────────── -->
<div id="header">
  <div class="brand">Cooper<span>Corp</span> AGI</div>
  <div class="live-indicator">

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<div class="nav-tab" data-tab="broadcast">Broadcast</div>
</nav>

<!-- ── Main ───────────────────────────────────────────────── -->
<main id="main">

  <!-- OVERVIEW -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
  </div>

  <!-- TASKS -->
  <div class="tab-panel" id="tab-tasks">
    <div class="filter-bar" id="task-filter-bar">
      <button class="filter-btn active" data-filter="all">All</button>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises a one-command GitHub export/push workflow but does not clearly warn users that workspace contents, generated agent files, prompts, task data, and possibly sensitive project material may be transmitted to an external third-party service. In a tool designed to bootstrap and manage multi-agent workspaces, that omission materially increases the risk of accidental data exfiltration by users who may assume export is local or fully safe by default.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup flow describes automated cron registration, framework installation, GitHub push, workspace commits, and persistent LaunchAgent/dashboard behavior without a prominent warning that these actions modify the local system, create persistence, install software, and may send data off-host. In an interactive bootstrapper, users may run setup expecting configuration only, making the missing safety disclosure a meaningful security and trust issue.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly instructs use of shell, filesystem writes, network access, Git/GitHub operations, and environment-dependent commands, yet it declares no explicit tool scope or permissions. That makes the skill over-privileged by omission and prevents users or a runtime from constraining high-risk actions such as agent creation, cron registration, repo publishing, and local service startup.

Session Persistence

Medium

• Category: Rogue Agent

Content

Store as `FRAMEWORKS` list. `all` → `["autogen", "crewai", "langgraph"]`.

### Step 5 — GitHub
> "Create a GitHub repo for the bundle? yes / no"

Store as `CREATE_GITHUB`.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.