Security audit

agent-init

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it also adds persistent self-improvement behavior outside the requested AGENTS.md/CLAUDE.md task.

Install only if you are comfortable with a skill that inspects repositories and rewrites project-level AI instruction files. Before using it, remove or ignore the self-evolution section, require explicit approval before any file writes, and review generated AGENTS.md or CLAUDE.md diffs before committing them.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill’s stated purpose is to generate or update project-level AGENTS.md/CLAUDE.md files, but it also instructs the agent to append to diary files and submit PRs modifying its own SKILL.md. That expands scope from project documentation into self-modification and persistent repository changes, creating an unsafe path for unauthorized edits and prompt-injection persistence.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The invocation examples are broad enough that ordinary user requests like 'create project rules' or 'generate project documentation for AI agents' could trigger the skill in contexts the user did not explicitly intend. Because the skill can initialize or update project-root instruction files that influence future agent behavior, ambiguous activation boundaries increase the risk of unintended file modification and prompt-surface changes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly promotes creating or updating AGENTS.md/CLAUDE.md in the project root, but does not warn that these may already exist, contain important hand-written instructions, or alter repository behavior for downstream AI tools. In this context, silent or assumed modification of repository instruction files is risky because these files are high-leverage control points that can affect subsequent automated actions across tools.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger description includes broad phrases like creating project docs, setup agent guidelines, or project rules, which can match common requests not specifically about AGENTS.md/CLAUDE.md. Over-broad activation increases the chance the skill runs in unintended contexts and performs file-writing behavior when the user did not clearly ask for this specific artifact.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill directs the agent to create or update AGENTS.md/CLAUDE.md in place, including overwriting existing files, without requiring explicit confirmation or warning about persistent changes. In an automated agent setting, this can lead to unintended repository modifications, loss of hand-written content, or changes committed under ambiguous user intent.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: These instructions tell the agent to append failure notes to diary files and submit a PR modifying SKILL.md, causing persistent changes outside the user-requested deliverable. This is especially dangerous because it creates a mechanism for repository mutation and long-term instruction drift without clear authorization.

Static analysis

No suspicious patterns detected.