simplify-and-harden

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:49 PM UTC
• Version: 1.0.1

Overview

The skill is a bounded code-review helper, but its learning loop can persist generated rules into future agent instructions without clear approval controls.

Install only if you are comfortable with the agent making automatic cleanup and simple security edits to files it changed. Disable or require explicit approval for the learning loop before use in shared or production repositories, and prefer a pinned, reviewed install source.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Third-Party Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-18
Vulnerability Type: Unpinned external dependency installation
Risk Level: Medium

Vulnerable Code

bash

## Install

npx skills add pskoett/pskoett-ai-skills/simplify-and-harden

For CI-only execution, use:

bash

npx skills add pskoett/pskoett-ai-skills/simplify-and-harden-ci

Technical Analysis

The documented installation commands retrieve third-party skill content without specifying an immutable commit, signed release, version, checksum, or other integrity constraint. The source therefore remains mutable after this audit.

Running the commands through npx also introduces trust in the package resolution and installation chain. The user cannot confirm from these commands that the installed skill is the same content that was previously reviewed. This creates a supply-chain risk if the upstream repository, publishing account, resolved package, or dependency chain is compromised.

No evidence in the audited files proves that the current upstream content is malicious. The vulnerability is the absence of integrity controls around installation from a mutable external source.

Attack Path

1. An attacker compromises the upstream repository, publishing account, or another component involved in resolving the installation command.
2. The attacker modifies the skill content or substitutes a malicious component.
3. A user follows the documented unpinned npx skills add command.
4. The installation process retrieves the modified content rather than the version covered by this audit.
5. The newly installed skill is trusted by the coding agent and may execute malicious instructions or code within the permissions available to that agent.

Impact Assessment

Successful exploitation could grant the malicious skill the effective privileges of the user or coding-agent process that installs and invokes it. Depending on the host a ...[truncated 372 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mutable repository references with an immutable, reviewed commit hash or cryptographically signed release.
2. Publish and verify a SHA-256 or stronger checksum for the complete installed artifact.
3. Pin the npx package and all relevant dependencies to exact versions rather than relying on mutable resolution.
4. Use package-manager integrity metadata and a committed lockfile where applicable.
5. Display the resolved source, version, and commit before installation and require explicit confirmation.
6. Review installed files before activating the skill in an agent context.
7. Run installation and initial validation in a sandbox with restricted filesystem, network, credential, and tool access.
8. Establish a release-signing and provenance-verification process so consumers can verify that artifacts originate from the expected maintainer.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:349

Finding

Generated Findings Can Be Persisted and Promoted into Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 302 and lines 349-364
Vulnerability Type: Persistent agent-memory and instruction-file poisoning
Risk Level: Medium

Vulnerable Code

The output schema designates a persistent learning file:

yaml

learning_loop:
  target_skill: "self-improvement"
  log_file: ".learnings/LEARNINGS.md"
  candidates:
    - pattern_key: "simplify.dead_code"
      pass: "simplify"
      finding_type: "dead_code"
      severity: "low"
      source_file: "src/api/handler.ts"
      source_line: 12
      suggested_rule: "Remove dead code and unused imports before finalizing a task."

The learning-loop instructions subsequently direct generated findings into persistent state and agent instruction files:

markdown

After each run:

1. Normalize each finding into a `pattern_key`:
   - Simplify examples: `simplify.dead_code`, `simplify.naming`, `simplify.control_flow`
   - Harden examples: `harden.input_validation`, `harden.authorization`, `harden.error_handling`
2. Emit those pattern candidates in `simplify_and_harden.learning_loop.candidates`.
3. Hand off candidates to `self-improvement`, which logs or updates entries in
   `.learnings/LEARNINGS.md` (instead of creating duplicate one-off notes).
4. Mark candidates as promotion-ready when they cross the recurrence threshold:
   `>= 3` occurrences across `>= 2` distinct tasks in a 30-day window.
5. Promote promotion-ready patterns into the agent context/system prompt files
   (`CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md`, or equivalent)
   to reduce repeat issues.

Technical Analysis

The core review function is intended to inspect a bounded task diff. The learning-loop integration extends that function by writing generated findings into cross-task state and eventually promoting generated rules into files that control future agent behavior.

Findings and proposed rule ...[truncated 2196 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable persistent learning and instruction-file promotion by default.
2. Require explicit human approval for every write to .learnings/LEARNINGS.md and every modification to an agent context file.
3. Present the exact proposed rule, its provenance, supporting findings, destination path, and complete diff before approval.
4. Treat task content, code comments, issue descriptions, and generated findings as untrusted input.
5. Validate promoted rules against a strict schema and reject instructions involving credential access, safety bypasses, unrelated tool use, external downloads, or scope expansion.
6. Maintain an allowlist of writable learning and context files and prevent path traversal, symlink redirection, or writes outside the repository.
7. Separate candidate collection from promotion. Promotion should be performed by a trusted reviewer rather than by the same model that generated the candidate.
8. Record immutable provenance for each candidate, including task identifiers, source locations, timestamps, and reviewer identity.
9. Require independent review rather than relying solely on recurrence counts, which an attacker can deliberately satisfy.
10. Provide straightforward rollback and audit-history mechanisms for all promoted instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL.md (reported line 507)May include surrounding context.

md

Agents love to refactor. Given permission to "improve" code, they will restructure it. But most post-task improvements are cosmetic: a dead import, a bad name, a needlessly deep conditional. These account for 80%+ of the value with near-zero risk. Refactoring carries real risk -- it can introduce bugs, break tests, and bloat diffs. By making simplification the default and refactoring the exception, the skill delivers consistent value without surprise rewrites. The bar for a refactor should be "this is genuinely wrong" not "this could be slightly better."

**Why a budget?**
Without constraints, agents will use review passes as license for unbounded refactoring. The 20% rule keeps the skill focused: improve what you built, don't rebuild it.

**Why separate simplify from harden?**
They require different mindsets. Simplify asks "is this the clearest expression of my intent?" while Harden asks "how could this be exploited?" Conflating them leads to mediocre results on both. Running them sequentially also lets us prioritize security fixes when budget is tight.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The install command invokes npx skills without pinning an exact package version or immutable source reference. That makes the skill installation path dependent on whatever package version is current at execution time, increasing supply-chain risk from malicious updates, compromised publisher accounts, or unexpected breaking changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The CI variant is also installed via unpinned npx skills, which is especially risky in automated environments because the fetched code may change between runs. In CI, this can lead to non-reproducible behavior or arbitrary third-party code execution if the upstream package is tampered with.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill authorizes automatic cosmetic fixes and security patches, but the high-level description does not prominently warn users that code may be modified without an additional confirmation step. In an agent setting, unclear auto-write behavior can cause unreviewed changes, policy bypass in sensitive repos, or surprising edits when users expected advisory-only review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented learning loop expands a bounded post-completion review skill into cross-task persistence and behavioral adaptation. That broadens the skill's authority from reviewing the current diff to accumulating and promoting rules across tasks, which can create prompt-memory poisoning, unintended policy drift, or repository state changes beyond the user's immediate intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest presents the skill as a bounded review sweep, but the behavior includes updating .learnings/LEARNINGS.md and promoting content into agent context files. This mismatch is dangerous because users may authorize a local review action without realizing it can alter persistent project or agent memory, affecting future behavior and potentially inserting incorrect or adversarial guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The learning-loop section states that findings are handed off to self-improvement, which logs or updates .learnings/LEARNINGS.md, but this repository-write behavior is not surfaced as a prominent warning. Silent persistence is riskier than ordinary auto-fixes because it changes long-lived project state and can influence later agent behavior beyond the current task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Across multiple snippets, the skill authorizes automatic cleanup and security changes in interactive sessions without a clear upfront confirmation step. This creates an autonomy/consent gap: an agent may alter source code beyond the user's expectations, and 'cleanup' can mask substantive behavior changes or introduce defects while appearing low-risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

These instructions explicitly tell the agent to apply simple security patches directly in interactive mode without first surfacing the change to the user. Even if the changes are intended to improve security, silent code modification reduces user oversight and can let an agent make incorrect, overbroad, or behavior-altering changes under the guise of 'hardening.'

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/agent-context-snippets.md (reported line 163)May include surrounding context.

• Only files you changed in this task
• Max 20% additional diff
• Simplify is the default, refactor is the exception
• Never apply a refactor without asking first

text

### .windsurfrules (Windsurf)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/agent-context-snippets.md (reported line 248)May include surrounding context.

md

> **Precaution:** The refactor stop hook depends on the agent actually pausing 
> and waiting for human input. Not all agents are equally reliable at this. Some 
> may acknowledge the instruction but proceed anyway, especially under aggressive 
> autonomy settings or in agentic loops with auto-approve enabled. Test your 
> agent's compliance before trusting it with this skill in production. If an agent 
> consistently fails to stop on refactors, reinforce the instruction with stronger 
> phrasing (e.g., "STOP. Do not proceed. Wait for my explicit approval.") or

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

Most agents solve the ticket and stop. This skill turns "done" into "done well."

The operating philosophy is a deliberate "fresh eyes" self-review before moving on: carefully re-read all newly written code and all existing code modified in the task, and look hard for obvious bugs, errors, confusing logic, brittle assumptions, naming issues, and missed hardening opportunities. The goal is not to expand scope or rewrite the solution -- it is to use peak context to perform a disciplined first review pass while the agent still remembers the intent behind every change.

## Best Use with Independent Review

Static analysis

No suspicious patterns detected.