Fully Automated Collaborative Code Development Pipeline

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:55 AM UTC
• Version: 1.0.1

Overview

This is a disclosed automated coding pipeline, but it needs Review because it can spawn sub-agents and write project files without asking first.

Use this skill only when you explicitly want a hands-off multi-agent code-generation workflow. Prefer running it in a clean or disposable workspace, review generated files before merging, and avoid using it on repositories containing secrets unless you are comfortable with full project context being passed through multiple sub-agent prompts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (18)

Hidden Instructions

High

• Category: Prompt Injection

Content

```
## file: <relative/path/to/file.ext>
​```<language>
<file content>
​```
```

• Confidence: 91% confidence
• Finding: The output template contains invisible Unicode characters before the markdown code fences, which can function as hidden instructions or formatting controls that are not apparent to reviewers. In an agent skill, hidden text is risky because it can alter downstream model behavior, evade human review, or interfere with parsers that consume the generated file structure.

Hidden Instructions

High

• Category: Prompt Injection

Content

## file: <relative/path/to/file.ext>
​```<language>
<file content>
​```
```

File paths are relative to the project root directory. Language tags should be correctly marked (javascript, typescript, python, go, etc.).

• Confidence: 91% confidence
• Finding: This second occurrence shows another invisible character embedded in the output-format example, again creating hidden prompt content that is not visible during normal review. Such concealed content is especially concerning in automation pipelines because it can cause ambiguous rendering, parser inconsistencies, or stealth instruction injection across tool boundaries.

Hidden Instructions

High

• Category: Prompt Injection

Content

```
## file: README.md
​```markdown
<content>
​```

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

```
## file: README.md
​```markdown
<content>
​```

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

```
## file: README.md
​```markdown
<content>
​```

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

```
## file: README.md
​```markdown
<content>
​```

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

```
## file: README.md
​```markdown
<content>
​```

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

```
## file: README.md
​```markdown
<content>
​```

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly directs a fully automated development pipeline that writes project artifacts into the workspace, but it does not require a user-visible warning or explicit consent before modifying files. In a code-generation skill, this increases the risk of unintended overwrites, surprise filesystem changes, or creation of unsafe code artifacts without the user understanding that persistent changes will occur.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### General Rules

1. **No-Interruption Principle**: Fully automated advancement; do not ask the user for confirmation. Report a progress summary after each phase is completed.
2. **Context Passing**: Each phase's sub-agent receives the complete output of the previous phase (technical specifications/architecture documents/code/test reports).
3. **Parallel Optimization**: S3 (Backend + Frontend) two sub-agents execute in parallel.
4. **Lightweight Scheduling**: For simple tasks (<100 lines of code, single file), S6 (Documentation) can be skipped; the PM writes a brief README directly.

• Confidence: 93% confidence
• Finding: The 'No-Interruption Principle' instructs the agent to proceed without asking the user for confirmation, even though later phases include code generation, testing, review-driven fixes, and integration actions that can materially alter the workspace. In the context of an autonomous software-development skill, removing human approval checkpoints increases the risk of unauthorized actions, unsafe code changes, and propagation of errors across phases before the user can intervene.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill states that each sub-agent receives the complete output of prior phases, which can include user-provided code, architecture, test reports, and potentially sensitive project context, yet it provides no warning, minimization rule, or consent boundary. This broad context propagation expands the exposure surface across multiple agent sessions and can leak secrets or proprietary code unnecessarily.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger conditions are broad enough to match many ordinary coding requests such as 'develop,' 'write code,' or 'implement,' causing the skill to auto-activate in situations where the user may not expect a multi-agent autonomous pipeline. Ambiguous activation increases the chance of overreaching behavior, including unnecessary spawning of sub-agents, excessive file generation, and bypass of normal user interaction patterns.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The skill hard-codes Chinese-only output regardless of the user's requested language or locale, which can override user intent and system-level language expectations. In an automated multi-agent development pipeline, this can degrade usability, cause downstream processing errors, and create prompt-injection-style instruction conflicts where the skill prioritizes its own formatting constraints over caller requirements.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The instruction "Output in Chinese" imposes a specific language unconditionally. This is a natural-language policy concern because the skill does not provide user opt-in, alternatives, or a stated region-specific justification for the locale restriction.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The instruction explicitly requires the README to be output in Chinese, which enforces a specific language regardless of user preference. This is a natural-language policy concern because the file does not offer opt-in, alternatives, or a documented region-specific reason for the constraint.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The skill hard-requires output in Chinese regardless of the user's language or any documented business need. In an automated development pipeline, this can cause downstream misunderstanding, review failure, or concealment of defects from users or agents expecting another language, which is a real security-relevant integrity and usability issue even if it is not a direct code-execution vulnerability.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: Line L53 states 'Output in Chinese,' which forces a specific language regardless of the user's preference or locale. This is a natural-language policy concern because the file does not provide opt-in, alternatives, or a region-specific justification for the restriction.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The instruction "Code comments can be in Chinese or English; be consistent" imposes a language constraint on generated natural-language content. This is a locale/language policy issue because the skill does not offer user choice or explain why only these languages are permitted.

Static analysis

No suspicious patterns detected.