Security audit

Phy Living Adr

Security checks for vulnerabilities and agentic risk

Overview

This skill edits local architecture decision documentation in the repository, and that behavior is clearly aligned with its stated purpose.

Install this if you want an agent to maintain ADR files in your repository. Review generated ADRs and supersession edits before committing, especially if the skill was triggered by a broad phrase rather than an explicit /living-adr request.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill advertises automatic creation of ADR files and updates to existing ADRs without an upfront warning that it will modify repository contents. This is risky because users may invoke it expecting analysis or drafting assistance, while the skill can create files, edit existing records, and alter project documentation state.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrase "document this decision" is broad, generic language that can appear in ordinary engineering discussion, causing the skill to activate without clear user intent. Because this skill writes new ADR files and may modify existing ADRs, accidental activation can lead to unintended repository changes and misleading documentation churn.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The phrase "why did we choose X" is ambiguous and commonly used in retrospectives, code review, or chat, so it can spuriously invoke the skill when the user is merely asking for explanation. In this context, unintended activation is more dangerous because the skill is designed to generate numbered files and potentially mark prior ADRs as superseded.

Static analysis

No suspicious patterns detected.