Repository Discovery

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:15 AM UTC
• Version: 1.0.1

Overview

This repository-discovery skill is mostly coherent, but it asks the agent to trust repository-controlled AI instructions and inspect live .env files without enough safeguards.

Install only if you are comfortable with an agent broadly reading the target repository. Before use, instruct the agent not to follow repository-embedded instructions that conflict with your request, not to open live .env or secret files, and not to write REPO_DISCOVERY.md unless you explicitly approve that output.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:55

Finding

Repository-Controlled Instructions Can Hijack Agent Behavior

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:55-63 and SKILL.md:294-302
Vulnerability Type: Repository-mediated prompt injection
Risk Level: High

Vulnerable Code Snippets:

markdown

Check for repository-specific AI instructions first.

Look for:

.github/copilot-instructions.md .github/agent.md .github/instructions.md

These files often contain:

-   coding conventions
-   architectural expectations
-   testing requirements
-   build instructions
-   agent workflows

If present, read them **before anything else**.

markdown

### Start With Instructions

Always prioritize:

.github/copilot-instructions.md .github/agent.md

These define how the repository expects AI agents to behave.

Technical Analysis

The skill instructs the agent to read repository-controlled AI instruction files before other content and to “always prioritize” them. A repository under analysis is an untrusted input boundary: its author can place arbitrary natural-language directives in .github/agent.md, .github/copilot-instructions.md, or .github/instructions.md.

The skill does not tell the agent to treat these files as untrusted documentation, reject instructions that conflict with higher-priority constraints, or limit their influence to extracting relevant coding conventions. Consequently, a malicious repository can attempt to alter the agent's current goals, suppress security checks, induce unrelated tool usage, or request access to sensitive resources.

Attack Path

1. An attacker creates or modifies one of the prioritized instruction files in a repository.
2. The attacker inserts directives requesting behavior unrelated to repository discovery, such as reading sensitive files, executing commands, concealing findings, or disclosing collected data.
3. A user invokes the repository-discovery skill against that repository.
4. The skill directs the agent to read the attacker-control ...[truncated 953 chars]

Remediation

View remediation

Remediation Suggestions

• Remove language that tells the agent to “always prioritize” repository-controlled instructions or read them before trusted task constraints.
• Explicitly classify all repository content, including AI guidance files, as untrusted data.
• State that system, developer, user, security, and authorization constraints always take precedence.
• Limit processing of repository guidance files to extracting relevant coding conventions, build requirements, and architectural facts.
• Require the agent to ignore directives that request unrelated tool use, secret access, external communication, destructive actions, suppression of findings, or changes to the assigned objective.
• Add prompt-injection detection guidance and require suspicious embedded instructions to be reported rather than executed.
• Apply least-privilege controls to file, shell, and network tools independently of natural-language instructions found in a repository.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:203

Finding

Repository Discovery May Read and Disclose Live Environment Secrets

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:203-213
Vulnerability Type: Unnecessary access to potentially sensitive configuration
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## 7. Locate Configuration and Environment Requirements

Search for:

.env.example .env config/ settings/

Document:

-   required environment variables
-   API keys
-   service endpoints
-   feature flags

Technical Analysis

The skill explicitly directs the agent to search for .env files and document API-key configuration without distinguishing example placeholders from live credentials. Unlike .env.example, a populated .env commonly contains active API keys, database passwords, access tokens, private service endpoints, and other secrets.

Repository discovery ordinarily requires environment-variable names and configuration requirements, not secret values. The absence of redaction requirements or a prohibition against opening live secret stores creates a risk that credentials will enter model context, logs, generated documentation, or subsequent conversations.

Attack Path

1. The target repository or working directory contains a populated .env file with active credentials.
2. The user invokes the repository-discovery skill.
3. Following the skill instructions, the agent searches for and reads .env.
4. The agent processes credential values while documenting environment requirements and API keys.
5. Secret values may be reproduced in REPO_DISCOVERY.md, retained in execution logs or model context, or exposed in later output.
6. Anyone able to access that output or context may use the disclosed credentials within the permissions granted to those credentials.

Impact Assessment

Potentially exposed data includes API keys, database credentials, authentication tokens, cloud-service credentials, private endpoints, and feature configuration. The resulting access is limited to the pe ...[truncated 354 chars]

Remediation

View remediation

Remediation Suggestions

• Do not open or process .env, credential stores, private keys, token caches, or other files likely to contain live secrets.
• Prefer .env.example, configuration schemas, deployment templates, and source-code references for identifying required variable names.
• Document environment-variable names and purposes only; never copy their values.
• Add mandatory redaction rules for tokens, passwords, private keys, connection strings, and other credential-like content.
• If configuration cannot be understood without inspecting a sensitive file, require explicit user authorization and disclose the reason before access.
• Prevent generated reports from containing secret values and scan report content for credential patterns before writing it.
• Recommend immediate credential rotation if a live secret is accidentally read or included in an output artifact.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The instruction to search for .env alongside config locations increases the chance the agent will open files containing plaintext secrets, tokens, or service credentials. In a repository-discovery context, this is especially risky because the skill then instructs the agent to document environment variables and endpoints, which can lead to secret exposure in generated output or downstream context.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md

Search for:

.env.example .env config/ settings/

Document:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The 'When to Use' section describes activation in very general terms such as starting work on a new repository, preparing for future development work, or creating documentation. These broad conditions overlap with many ordinary developer requests and do not define specific trigger phrases, boundaries, or negative examples, which could cause unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly directs the agent to produce REPO_DISCOVERY.md in the repository but does not warn that this modifies the working tree. In environments where analysis is expected to be read-only, this can cause unintended file writes, noisy diffs, CI side effects, or accidental inclusion of generated content in commits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.