coding-framework

• Outcome: Review
• Latest audit: Aug 3, 2026 · 1:13 AM UTC
• Version: 13.0.0

Overview

This coding automation skill has a coherent purpose, but it includes broad command execution and automatic Git/worktree mutation paths that are not safely scoped.

Install only if you are comfortable letting this skill run local commands and manage Git state. Use it in a clean repository or sandbox, avoid enabling auto-commit/auto-rollback by default, review any external-agent or push/PR workflow before use, and add explicit approval gates before destructive cleanup, checkout, or remote-write actions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (27)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # 先暂存所有变更
        subprocess.run(["git", "add", "-A"], capture_output=True, timeout=10)
        # 创建提交
        subprocess.run(
            ["git", "commit", "-m", f"chore: {message}", "--allow-empty"],

• Confidence: 95% confidence
• Finding: `git add -A` stages all working tree changes automatically, which can capture unintended or sensitive files and prepare them for commit without granular user confirmation. In the context of an agent skill, this broad repository mutation increases the risk of accidental data exposure or destructive workflow changes.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 先暂存所有变更
        subprocess.run(["git", "add", "-A"], capture_output=True, timeout=10)
        # 创建提交
        subprocess.run(
            ["git", "commit", "-m", f"chore: {message}", "--allow-empty"],
            capture_output=True, timeout=10
        )

• Confidence: 92% confidence
• Finding: This command creates Git commits automatically, including with `--allow-empty`, which mutates repository history without an interactive safeguard. While it does not appear to allow shell injection, it is still a potentially dangerous side effect for an automation skill because it can clutter or alter audit history and normalize silent state changes.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return {"success": False, "message": f"tag 不存在: {tag_name}"}
        
        # 回滚
        result = subprocess.run(
            ["git", "checkout", tag_name],
            capture_output=True, text=True, timeout=10
        )

• Confidence: 96% confidence
• Finding: `git checkout <tag>` changes the working tree to another revision and can discard local workflow state or confuse downstream automation, especially when run by an agent skill without warning or confirmation. Although argv form avoids shell injection, the action is destructive enough to be a genuine security/safety risk in an automated context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

full_cmd = f"{command} {' '.join(str(f) for f in files)}"

    try:
        result = subprocess.run(
            full_cmd, shell=True, capture_output=True, text=True,
            timeout=timeout, encoding="utf-8", errors="replace"
        )

• Confidence: 99% confidence
• Finding: `run_gate` builds `full_cmd` as a string and executes it with `shell=True`, appending file paths derived from user input without quoting or escaping. An attacker can supply crafted file names or `--files` values containing shell metacharacters to achieve arbitrary command execution on the host.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill declares `exec` even though its stated purpose is static performance analysis, which can be fulfilled with read/search-only capabilities. Unnecessary shell execution expands the attack surface significantly: if invoked on untrusted repositories or influenced by prompt injection in analyzed files, the agent could be induced to run arbitrary commands despite the documented static-only role.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The prompt explicitly says the agent performs only static analysis and does not do runtime testing, yet the skill still exposes command execution. This mismatch is dangerous because operators may trust the documentation and deploy the skill in broader contexts, while the available tool capability still permits command execution if the model is manipulated or misbehaves.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The skill uses extremely broad keyword-based routing to auto-load other skills and alter behavior during ordinary conversations. In an agent environment, vague triggers can be induced by untrusted user or repository content, causing unintended mode switches, overreach, or execution of riskier workflows than the user intended.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The design-gate trigger conditions are broad enough to activate on many normal coding requests, forcing additional reads, workflow changes, and possible file writes. That increases the attack surface for prompt-injection-style steering because ordinary task wording can redirect the agent into complex orchestration behavior without clear user consent.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: Automatic preloading based on generic words like 'security', 'agent', or 'example' allows benign conversation text to pull in extra documents and instructions. In a hostile repository or prompt-injection setting, this can be abused to manipulate context selection and steer the agent toward attacker-chosen material.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger examples include short, generic phrases like '模块设计', '依赖关系', and '系统扩展性', which can match many ordinary developer requests and cause the skill to activate unintentionally. Because the skill imposes a specialized review behavior and output schema, broad invocation can misroute tasks, override better-suited agents, or create confusing behavior in contexts that did not request architectural critique.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: The skill is written entirely in Chinese and instructs behavior in Chinese without any indication that this should depend on user preference or conversation language. This can lead to undesired language switching, reduced usability, and possible misunderstanding of review results, especially in multilingual systems where the caller expects the agent to preserve the user's language.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger examples include broad everyday phrases such as '帮我看看这个文件' and '这段代码怎么样', which can cause the skill to activate outside a clearly scoped code-review intent. Because the skill has access to exec, accidental invocation increases the chance that an agent routes tasks to a more privileged skill than necessary, expanding attack surface and enabling misuse through prompt steering.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger examples include very broad phrases such as '快速看一下', '侦察一下', and 'explore', which are plausible in ordinary conversation and can cause the skill to activate when the user did not intend to invoke it. Because this skill has tool access including Read, Grep, Glob, and exec, unintended activation can lead to unnecessary repository inspection and disclosure of codebase structure or file metadata.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger examples are generic phrases like '审查前端代码' and 'UI审查', which create ambiguous activation boundaries and increase the chance this skill is invoked for broad frontend tasks outside its intended narrow review scope. Overbroad routing can cause misapplication of the skill, unintended authority in multi-skill environments, and unreliable security or quality decisions because the skill may capture requests better handled by other specialized agents.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The skill is presented and instructed entirely in Chinese without indicating whether this locale restriction is intentional or offering fallback behavior for users in other languages. This can lead to user misunderstanding, misrouted reviews, or incomplete security/quality feedback when the surrounding system or source artifacts are multilingual, though it is not inherently a code-execution or privilege-escalation issue.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger examples include broad, common phrases such as '安全检查', 'security audit', and '这段代码安全吗', which can cause the skill to activate in contexts beyond the author's likely intent. In a skill with access to powerful tools including exec, unintended activation increases the chance that a generic request is routed into a high-privilege workflow, expanding attack surface and enabling misuse or accidental execution paths.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger examples are broad enough to match common review requests, which can cause the skill to activate outside a tightly scoped context. In an agent system, over-broad invocation increases the chance this reviewer is selected unexpectedly, leading to inappropriate routing, unintended authority, or misuse in contexts the skill was not designed to handle.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: On a timeout, the hook can automatically invoke `loop-controller.py rollback --prev` when `auto_commit` is enabled, and all output/errors are suppressed while failures are ignored with `|| true`. That means a potentially destructive state-changing operation can occur during shutdown without explicit user confirmation, visibility, or a reliable audit trail, increasing the risk of silent data/work loss.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The routing logic is described as broad keyword, file-type, and task-type matching with a default fallback, but it does not define negative conditions, tie-breakers, or authorization boundaries. In an agent orchestration system, ambiguous dispatch can send sensitive requests to a more privileged agent such as one with exec access, increasing the chance of unintended tool use or unsafe execution paths.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The specification for trigger_examples is underspecified and only asks for example messages, without requiring precise patterns, exclusions, or validation criteria. This makes prompt-based routing easier to manipulate through vague or adversarial phrasing, potentially activating the wrong agent and exposing broader tool permissions than intended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documented workflow instructs an external agent to "Commit and push," and then proceeds to create a PR automatically, which can cause unreviewed or unintended code changes to be published to a remote repository. In this context, the risk is elevated because the same file also recommends high-autonomy agent modes such as `codex --yolo` / `--full-auto`, making it more likely that users will delegate repository-changing actions without an explicit confirmation or warning about user impact.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide includes destructive commands (`git worktree remove` and `git branch -D`) for abandoning a feature, but it does not explicitly warn that uncommitted or unmerged work can be irreversibly lost. In an agent skill or automation-oriented workflow guide, users may copy commands directly, which increases the chance of accidental data loss.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The rollback capability performs repository state changes without strong user-facing warnings or confirmation, increasing the chance of accidental destructive use. In an agent skill context, silent Git checkout operations are more dangerous because users may not realize automation can rewrite their working context.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Beyond the command injection issue, this code silently executes external commands discovered from the repository/tooling context without explicit user warning. In an agent skill, hidden command execution expands the trust boundary and can cause users to unknowingly run tests, linters, Node tooling, or shell commands from an untrusted project.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The cleanup routine performs destructive operations (`git worktree remove` and optionally `git branch -d`) over all managed worktrees without any confirmation, dry-run mode, or explicit safety interlock. In an agent or automated context, a mistaken invocation can cause loss of uncommitted work or unintended branch deletion, making this materially risky even if it is not a remote-code-execution issue.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.