Agent Visio Use

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:50 PM UTC
• Version: 0.1.2

Overview

This skill is a clear DiagForge bootstrap guide, but it tells agents to clone and run unpinned external repository code while also declaring a local bridge token requirement.

Install only if you trust the DiagForge GitHub repository and maintainer. Before running the smoke test, verify the repository state yourself, avoid exposing VISIO_BRIDGE_TOKEN until it is needed by the local bridge, and run the cloned code with the least filesystem and environment access practical.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:68

Finding

Execution of Mutable and Unverified Code from an External Repository

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 68-104
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: High

The skill directs agents to clone a mutable external GitHub repository and execute Python scripts that are not included in the reviewed package.

Vulnerable Code

markdown

The full project lives in the GitHub repository:

`https://github.com/qweadzchn/DiagForge`

## Recommended workflow

1. Clone the GitHub repository locally.
2. Read the cold-start entry documents.
3. Run the canonical smoke test before doing open-ended drawing work.
4. Only then move on to real jobs or system improvements.

## Clone the repository

```bash
git clone [e-mail]:qweadzchn/DiagForge.git
cd DiagForge

If SSH is not available, use HTTPS instead.

Read order

Read these files first:

1. AGENT_START_HERE.md
2. AGENT_GUIDE.md
3. GET_STARTED.md
4. docs/human/setup/AGENT_COLD_START_SMOKE_TEST.md
5. MODE_POLICY.md

Canonical smoke test

From the repo root:

powershell

python Setup\prepare_smoke_test.py --config Setup\examples\smoke-test-inputpng-1.json
python Setup\run_draw_job.py --config Setup\examples\smoke-test-inputpng-1.json
python Setup\execute_drawdsl.py --config Setup\examples\smoke-test-inputpng-1.json --round 1 --save-final

text

### Technical Analysis

The package contains only documentation and does not include the Python scripts it instructs the agent to run. The clone command does not pin the repository to an immutable commit, verify a cryptographic checksum, or validate a trusted signature. Consequently, the code executed by an agent can differ from the code that existed when this skill was reviewed.

The prescribed read order also introduces additional mutable external instructions before execution. Although no malicious content was found in the local documentation itself, neither those external document
...[truncated 1775 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the upstream repository to a specific, reviewed commit hash rather than cloning and executing the default branch.
2. Verify the expected commit identity, signed tag, or release signature before executing any code.
3. Publish cryptographic hashes for every script and configuration file used by the smoke test, and abort execution if verification fails.
4. Prefer bundling the minimum required scripts in the skill package so their exact contents are included in the security review.
5. Require explicit user confirmation before cloning external content or executing any retrieved script.
6. Run the smoke test in a sandbox with restricted filesystem access, minimal environment variables, no unnecessary credentials, and network access disabled unless explicitly required.
7. Avoid exposing VISIO_BRIDGE_TOKEN to setup stages that do not require it. Provide the token only to the specific bridge process that consumes it.
8. Review and pin transitive Python dependencies and modules imported by the three entry-point scripts.
9. Document the exact trusted repository owner, revision, verification procedure, and expected script hashes in SKILL.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill manifest requires a sensitive environment variable (VISIO_BRIDGE_TOKEN) but provides no guidance on secure sourcing, storage, redaction, or scope limitation. In an agent-oriented bootstrap skill, this can encourage operators or downstream automation to inject high-value credentials into broad execution contexts, increasing the chance of accidental disclosure through logs, prompts, subprocesses, or inherited environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.