code-doc-guid

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:53 AM UTC
• Version: 1.0.2

Overview

This skill appears to be a local code-indexing helper, but it tries to make itself a mandatory gate for many coding tasks and writes persistent project metadata, so users should review it before installing.

Install only if you want an agent-facing tool that can scan your codebase and keep local dependency metadata under .trae. Before using it in private or regulated repositories, decide whether persistent symbol, path, docstring, and dependency indexing is acceptable, and consider editing the skill text so usage is optional rather than a mandatory gate for every code change.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3

Finding

Mandatory Agent Workflow and Instruction Hijacking

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description frames the skill as a navigation/documentation assistant, but the behavior described goes beyond passive guidance into persistent indexing, subprocess interaction with git, artifact generation, and repository analysis. This mismatch can mislead operators and policy systems about the true authority and side effects of the skill, causing it to be approved or invoked in contexts where those extra capabilities are unsafe.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly instructs the agent to use shell commands and to perform file-modifying workflows, but it does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization ambiguity where a host may expose broader read/write/shell capability than intended, increasing the chance of unintended repository changes or command execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is framed as a navigation/documentation assistant, but it silently creates a persistent SQLite index under .trae, which is a side effect beyond read-only inspection. In agent contexts, hidden persistence can leak code structure, retain sensitive metadata longer than expected, and violate user assumptions about when file-system modifications occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code writes a SQLite database into .trae without an explicit warning in the user-facing interface, which is a transparency and consent issue. For a skill expected to assist with navigation, undisclosed persistent storage can surprise users, leave sensitive project metadata on disk, and create policy/compliance concerns in restricted environments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill executes git commands through subprocess to detect changed files. While change detection can support incremental indexing, spawning external processes is a distinct capability not mentioned in the manifest and is broader than straightforward code parsing/indexing. This is especially relevant because the manifest does not describe shell or VCS command execution as part of the skill's scope.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/codebase_manager.py (reported line 550)May include surrounding context.

python

changed = set()
        try:
            # Check for unstaged changes
            output = subprocess.check_output(['git', 'diff', '--name-only'], cwd=self.root, text=True)
            for line in output.splitlines():
                if line.strip():
                    changed.add(os.path.join(self.root, line.strip()))

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/codebase_manager.py (reported line 556)May include surrounding context.

python

changed.add(os.path.join(self.root, line.strip()))
            
            # Check for staged changes
            output = subprocess.check_output(['git', 'diff', '--name-only', '--cached'], cwd=self.root, text=True)
            for line in output.splitlines():
                if line.strip():
                    changed.add(os.path.join(self.root, line.strip()))

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/codebase_manager.py (reported line 562)May include surrounding context.

python

changed.add(os.path.join(self.root, line.strip()))
                    
            # Check for untracked files
            output = subprocess.check_output(['git', 'ls-files', '--others', '--exclude-standard'], cwd=self.root, text=True)
            for line in output.splitlines():
                if line.strip():
                    changed.add(os.path.join(self.root, line.strip()))

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The inspect operation performs disk writes by generating .trae/codeguiddoc.md, even though an inspection command is typically expected to be non-mutating. In an automated agent workflow, this can create or overwrite files without clear authorization, potentially altering workspace state and causing unintended disclosure of dependency information into a durable artifact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The inspect path overwrites codeguiddoc.md under .trae with no explicit warning, despite the command name implying analysis rather than mutation. This hidden write can clobber prior reports and silently persist potentially sensitive dependency summaries generated from the codebase.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The graph command writes architecture_layers.md and dependency_graph.json to disk without prior disclosure, introducing hidden side effects for what may be perceived as a reporting action. These artifacts can expose internal architecture details and alter the repository/workspace state in automated settings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The markdown describes running update, which scans the project and updates a local SQLite database at .trae/codebase.db, but it does not explicitly warn users that executing the skill will create or modify files in the workspace. Under the markdown criteria for missing user warnings, behaviors that affect user data or system state should be disclosed clearly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation states that graph generates architecture_layers.md and dependency_graph.json, but it presents this as a feature without an explicit caution that running the command will write new files to the working tree. Because this behavior can alter project contents, a clear warning helps users understand the impact before invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The heading includes the Chinese phrase '触发条件' alongside English instructions in a mandatory section. This introduces a language-specific element without any user opt-in or stated locale justification, which can violate language/locale policy requirements for natural-language content.

Content

No source excerpt is available for this finding.