Security audit

Agent Roundtable

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real roundtable discussion tool, but it includes network sharing, external chat notifications, subprocess/browser behavior, and broad persistence that need review before installation.

Install only if you are comfortable with discussion text being persisted locally and, when configured, shared through a web viewer or external chat. Keep the web viewer disabled or bound to localhost unless remote access is intentional, avoid notifications for confidential discussions without recipient approval, constrain output paths, and review or remove bundled release/ops scripts before using this in a sensitive environment.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (60)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: cmd = ["xdg-open", web_url] try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=5) except (FileNotFoundError, subprocess.TimeoutExpired) as exc: logger.debug("Could not auto-open browser for web viewer: %s", exc) return False, str(exc)
Confidence: 82% confidence
Finding: The code launches a local browser helper with a URL derived from discussion creation results, without validating the scheme or destination. Even though subprocess.run is invoked without a shell, opening attacker-influenced URLs can still trigger unsafe handlers, local application launches, or user redirection if web_url can be influenced by untrusted input elsewhere in the stack.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The UI tells users that link access has been revoked for everyone, but the JavaScript only changes the local DOM by hiding the main content and showing an 'invalid link' page. No backend request, token invalidation, or server-side access control change occurs, so the shared URL would remain valid for other users. In a collaboration/share feature, this is a security-significant integrity issue because users may believe sensitive discussion access has been removed when it has not.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The modal text promises that revoking the share link will immediately invalidate access for all holders, but the implementation only clears the input locally and disables the button in the current browser. This creates a deceptive security control: users may believe access has been revoked when the original URL likely remains valid, leading to unintended continued access to a discussion link.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The design materially expands the skill from a discussion/conclusion engine into a network-accessible web application with browser delivery, tokenized access, SSE, and revocation APIs. Even if intended as a usability feature, this increases attack surface, introduces remote data exposure risk, and creates capabilities not clearly justified by the stated skill scope.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: Launching and managing external processes via PM2 and subprocess introduces powerful host-level side effects beyond normal discussion processing. This creates opportunities for command misuse, persistence, process sprawl, and unintended execution of system-installed tools, especially if discussion identifiers, paths, or runtime settings become influenced by untrusted input elsewhere in the skill.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The design exposes HTTP and SSE endpoints on 0.0.0.0, making discussion data remotely reachable to anyone with network access and a valid token. Token-only access control is weak as a sole boundary for sensitive conversation content, and the added network interface creates risks of unauthorized viewing, brute-force attempts, leakage through logs/referrers, and denial of service.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: This script can unpublish npm packages, delete local and remote git tags, revert commits, and push repository state changes. Those are destructive release-management capabilities that are unrelated to a skill described as a multi-agent roundtable discussion tool, so including them materially expands the attack surface and creates risk of unauthorized supply-chain or source-control tampering if the skill is invoked or packaged unexpectedly.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file header explicitly documents destructive rollback actions including npm unpublish, tag deletion, commit reversion, and pushing changes. In the context of a discussion-oriented agent skill, this is a strong scope mismatch: users or downstream systems would not reasonably expect source-control and package-registry mutation behavior, making accidental or abusive execution more dangerous.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: _write_markdown_output writes attacker-controlled content to a caller-controlled filesystem path with Path(output_path).expanduser() and creates parent directories if needed, with no base-directory restriction or path validation. In an agent or service context, this enables arbitrary file write within the process's permissions, which can overwrite configuration, plant files in sensitive locations, or prepare follow-on code execution depending on deployment.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The skill exposes a live web viewer and returns a URL, which materially expands its capabilities beyond purely local debate/conclusion generation. That increases the attack surface by making discussion data accessible over HTTP and creates a new sharing channel that users may not expect from the manifest description.

Context-Inappropriate Capability

High

Confidence: 88% confidence
Finding: This code starts and stops external PM2/Node processes to host a service, which is a significant privilege and capability expansion for a discussion skill. Even without classic command injection, spawning managed subprocesses can be abused for persistence, broader system interaction, and unexpected network exposure if an attacker can influence runtime behavior or deployment context.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The code probes for an available port and prepares to host an HTTP service, which creates an unintended local network surface for a skill whose stated purpose is roundtable discussion. In context, this is more dangerous because the class defaults to binding on 0.0.0.0, increasing the chance of exposure beyond the local machine.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill materially expands beyond discussion orchestration into external message delivery, browser launching, subprocess execution, and web-server management. Those side effects can expose data to third-party channels or alter the local environment in ways a user may not expect from a 'roundtable discussion' skill.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: The browser auto-open, PM2/Express process management, and subprocess-based UX actions introduce environment-modifying behavior not essential to the core discussion function. In an agent setting, unnecessary side effects increase attack surface and can be abused for data exposure, persistence, or unexpected command execution paths.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The shell bootstrapping and direct Python execution instructions encourage operators or agents to run ad hoc environment-modifying commands outside the primary skill boundary. This increases the likelihood of unsafe execution, path injection, accidental misuse of local interpreters, or bypassing normal tool safety controls.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The documentation claims a tool exists and later says it does not, creating an unsafe operational inconsistency. In agent workflows, contradictory instructions can cause fallback to unintended commands, error-handling branches, or workaround execution paths that bypass safeguards.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The skill instructs users to rely on convergence metrics while elsewhere admitting those metrics are unreliable or unimplemented. This can cause incorrect automation decisions, premature termination, or unjustified trust in system-generated status when coordinating multi-agent actions.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documentation explicitly states that discussion notifications are pushed to a company Feishu group, which extends behavior beyond the advertised roundtable/debate scope into external communications. Even though this is only an example document, it normalizes outbound messaging that can leak internal discussion content to unintended recipients if operators copy the pattern without explicit consent, scope declaration, or access controls.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The example provides concrete code for sending a message after each speech to an external Feishu group, effectively serving as implementation guidance for data exfiltration outside the core discussion workflow. This is dangerous because participants' statements, summaries, or sensitive project context could be broadcast broadly without user awareness, minimization, or authorization checks.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: Listing multiple pushed company-group notifications as part of the documented output implies that external dissemination is an expected product behavior rather than an incidental manual step. In a multi-agent discussion skill, that increases risk because generated content may include confidential business context, debate artifacts, or internal planning details that should remain local unless explicitly approved for sharing.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: This reference file for a roundtable discussion skill documents and normalizes post-discussion operational actions that go well beyond discussion/conclusion generation, including task dispatch and security remediation workflows. In the context of an agent skill, such examples can expand the perceived authority of the skill and encourage an agent or operator to perform unrelated state-changing actions without proper authorization or scope checks.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documented steps include destructive repository rewriting, credential rotation, editing local configuration, restarting infrastructure, and validating tokens against an external API. Those are privileged security/operations actions unrelated to a roundtable discussion skill, so embedding them in this skill reference creates dangerous scope creep and could lead an agent to perform sensitive actions under the guise of routine discussion follow-up.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This reference example expands the skill from internal roundtable orchestration into external real-time broadcasting to a Feishu company group. That creates a data-flow capability not implied by the skill’s stated purpose, increasing the chance that discussion content, internal planning details, or sensitive prompts are transmitted outside the immediate agent context without explicit user understanding or governance.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The example operationalizes outbound messaging to a company-group chat, including launch, speech summaries, round summaries, and final conclusions. Because this external messaging is not clearly justified by the roundtable skill’s narrow discussion purpose, users may unknowingly enable broad dissemination of generated content, which can leak internal strategy, participant context, or sensitive business information.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The documented design expands the skill from internal roundtable orchestration into outbound messaging to external Feishu channels, which creates a data egress path not implied by the skill's stated purpose. In a multi-agent discussion system, speeches and conclusions may contain sensitive user or model-generated content, so adding external notifications materially changes the trust boundary and increases leakage risk.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/release/bump-version.js:44

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/release/changelog.js:45