Multi-Agent Review - 多代理并行审查

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:45 AM UTC
• Version: 1.0.0

Overview

This skill is a code-review helper, but it gives some review agents command execution and forwards code to spawned agents without enough boundaries or user control.

Review this skill before installing if you use it on private or untrusted repositories. It should be safer if exec is removed from the test and performance agents by default, or limited to explicit user-approved commands in an isolated sandbox, and if the workflow documents what code is shared with each spawned agent.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: agents/performance-analyst.yaml:12

Finding

Unnecessary Command-Execution Permission in the Performance Analysis Agent

Content

View full analysis

Vulnerability Details

File Location: agents/performance-analyst.yaml:12-16
Vulnerability Type: Excessive command-execution permission
Risk Level: Medium

Vulnerable Code

yaml

tools:
  - Read          # Read source code
  - Grep          # Search for performance patterns
  - Glob          # Find related files
  - exec          # Run performance analysis tools

The same agent is explicitly constrained to static analysis later in the file:

yaml

## Constraints

- Perform static code analysis only; do not conduct runtime testing
- Distinguish between theoretical complexity and practical impact
- Provide quantifiable optimization recommendations

Technical Analysis

The agent receives the unrestricted exec tool even though its declared task is static performance analysis and its system prompt explicitly prohibits runtime testing. This violates least privilege and creates an unnecessary code-execution channel.

Performance tools commonly load project configuration, import application modules, invoke build hooks, or execute benchmark and profiling scripts. In an untrusted repository, these components may contain attacker-controlled commands. Therefore, invoking a seemingly legitimate profiler or analysis command can execute repository code with the permissions available to the review environment.

Attack Path

1. An attacker submits a repository for review.
2. The repository contains a malicious import hook, build script, profiler configuration, benchmark, or package lifecycle hook.
3. The performance agent receives the repository content and has access to exec.
4. The agent invokes a performance-analysis command against the repository.
5. The command loads or executes the attacker-controlled component.
6. The component runs with the privileges and environmental access of the review process.

Impact Assessment

Successful exploitation could allow arbitrary command execution within the review environment. Depending on ...[truncated 478 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the agent and retain only the tools required for static analysis:

yaml

tools:
  - Read
  - Grep
  - Glob

2. If runtime profiling is genuinely required, separate it into an explicit opt-in workflow requiring user approval.
3. Run approved profiling only inside an ephemeral sandbox with:
   • Network access disabled by default.
   • A read-only project mount.
   • No host credentials or sensitive environment variables.
   • Strict CPU, memory, process, and execution-time limits.
   • A narrowly defined command allowlist.
   • No access to host sockets, home directories, or package-manager credentials.
4. Prevent profilers from loading repository-defined plugins, startup files, or arbitrary configuration where possible.
5. Preserve the existing static-analysis constraint and enforce it at the tool-permission layer rather than relying only on prompt instructions.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: agents/test-engineer.yaml:12

Finding

Unnecessary Command-Execution Permission in the Test Review Agent

Content

View full analysis

Vulnerability Details

File Location: agents/test-engineer.yaml:12-16
Vulnerability Type: Excessive command-execution permission
Risk Level: Medium

Vulnerable Code

yaml

tools:
  - Read          # Read source code and test files
  - Grep          # Search for test patterns and assertions
  - Glob          # Find test files
  - exec          # Run coverage tools

The agent's stated constraints only require coverage estimation through code analysis:

yaml

## Constraints

- Estimate coverage based on code analysis without inventing figures
- Prioritize missing tests for core logic
- Provide specific test-case recommendations

Technical Analysis

The test-review agent is granted unrestricted exec access even though its stated responsibilities can be completed through static inspection. Running coverage tools normally executes the project's test suite and may also trigger test discovery, imports, fixtures, setup scripts, package scripts, plugins, and build steps.

These components are controlled by the reviewed repository. A malicious repository can therefore place executable payloads in ordinary test infrastructure and rely on the review agent to launch them through a legitimate-looking coverage command. Prompt-level constraints do not technically prevent execution because the permission remains available.

Attack Path

1. An attacker creates or modifies a repository submitted for code review.
2. The attacker embeds a payload in a test file, test fixture, test-discovery hook, imported module, coverage plugin, package lifecycle script, or test configuration.
3. The test agent is launched with exec permission.
4. The agent invokes a coverage or test command.
5. Test discovery or execution loads the malicious component.
6. The payload executes with the permissions of the review process and accesses resources available in that environment.

Impact Assessment

Exploitation could result in arbitrary command execution in ...[truncated 443 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the default test-review agent:

yaml

tools:
  - Read
  - Grep
  - Glob

2. Keep coverage assessment static unless the user explicitly requests test execution.
3. If tests or coverage must be run, require informed user approval and use an isolated, disposable environment with:
   • No host secrets or inherited credentials.
   • Network access disabled by default.
   • A read-only source mount and separate disposable output directory.
   • Strict resource and timeout limits.
   • No privileged containers, host sockets, or host filesystem mounts.
   • An allowlist of approved test and coverage commands.
4. Disable automatic repository-defined plugins and package lifecycle hooks where supported.
5. Treat all tests, fixtures, configuration files, imports, and build scripts from the reviewed repository as untrusted executable content.
6. Record exactly which command would run and request confirmation before execution.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases are broad architectural terms that are likely to appear in ordinary discussion, which can cause this skill to activate outside clearly intended review contexts. That increases the chance of unintended tool-enabled codebase inspection and misleading architecture judgments being inserted into normal conversations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

All natural-language instructions and output expectations are written as mandatory Chinese behavior, with no indication that the user may choose another language. Under the language/locale policy, forcing a specific language without opt-in is a policy concern unless the restriction is explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger examples include generic phrases such as '文档检查', 'documentation review', and 'API 文档', which are broad enough to match ordinary user requests and may cause this skill to activate outside a narrowly intended scope. Over-broad activation can route unrelated conversations into this agent's fixed behavior, increasing the chance of incorrect tool use, unintended prompt influence, or task hijacking in multi-skill environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest's natural-language instructions are entirely in Chinese and present the agent persona and output expectations in a single language, with no indication that the user may choose another language. Under the stated policy, language constraints should be optional or explicitly justified when region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The system prompt is entirely written in Chinese and directly instructs the agent how to review and respond, with no indication that the user may choose another language. Under the policy, forcing a specific language without opt-in or a documented regional constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest and system prompt are entirely written in Chinese and instruct the agent in Chinese, while also including English trigger text. This creates a natural-language locale constraint without any documented user choice or opt-in, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest comments and tool list state that exec is available to run performance analysis tools, implying dynamic execution capability. However, the system prompt later constrains the agent to '基于代码静态分析，不做运行时测试' (static analysis only, no runtime testing), which is an active contradiction about whether execution-based analysis is part of the skill's behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest and system prompt are entirely written in Chinese and instruct the agent in Chinese without any indication that users may choose another language. This creates a locale/language policy concern because the skill appears to enforce a specific language by default rather than offering opt-in or documenting a region-specific justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The workflow explicitly says it will read agent prompts/configuration and include code contents in tasks sent to spawned sub-agents, but the document does not mention any data-classification, redaction, consent, or boundary controls. In a multi-agent system, this can lead to unintended disclosure of proprietary source code, secrets, or sensitive context to components that do not strictly need full access, especially if agents are externally hosted or differently trusted.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents the skill name, workflow, usage examples, and report format exclusively in Chinese. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.