Agent Visio User

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:50 PM UTC
• Version: 0.1.1

Overview

This bootstrap skill is coherent, but it tells agents to clone and run unpinned external repository code while requiring a token, without enough safety controls.

Install only if you are comfortable reviewing or trusting the DiagForge repository before running its scripts. Use an isolated environment, pin or inspect a specific commit, and avoid exposing VISIO_BRIDGE_TOKEN or other secrets to the smoke-test process unless they are strictly needed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:71
• Finding: Unpinned Remote Repository Code Is Retrieved and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 71–73, 80–91, and 102–108 **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown The full project lives in the GitHub repository: `https://github.com/qweadzchn/DiagForge` ``` ```markdown ## Recommended workflow 1. Clone the GitHub repository locally. 2. Read the cold-start entry documents. 3. Run the canonical smoke test before doing open-ended drawing work. 4. Only then move on to real jobs or system improvements. ## Clone the repository ```bash git clone [e-mail]:qweadzchn/DiagForge.git cd DiagForge ``` ``` ```markdown ## Canonical smoke test From the repo root: ```powershell python Setup\prepare_smoke_test.py --config Setup\examples\smoke-test-inputpng-1.json python Setup\run_draw_job.py --config Setup\examples\smoke-test-inputpng-1.json python Setup\execute_drawdsl.py --config Setup\examples\smoke-test-inputpng-1.json --round 1 --save-final ``` ``` ### Technical Analysis The skill directs an agent to clone an external Git repository and execute Python scripts from it. The clone operation does not pin an immutable commit hash, and the instructions do not require signature, checksum, or provenance verification before execution. Consequently, the effective executable payload is the repository's default-branch content at the time the instructions are followed, rather than code contained in and reviewed with this skill package. The repository owner—or an attacker who compromises the repository or its account—could modify the referenced scripts after the skill has been audited. The skill metadata also declares `VISIO_BRIDGE_TOKEN` as a required environment variable at `SKILL.md:13`. The audited package does not read or transmit this token itself, but remotely sourced scripts may inherit it if it is exposed in their execution environment. ### Attack Path 1. An agent loads the bootstrap skill and follows its rec ...[truncated 1219 chars]
• Remediation: ## Remediation Suggestions 1. Pin the repository checkout to a reviewed, immutable full commit hash. 2. Use cryptographically signed tags or releases and verify their signatures before execution. 3. If release archives are used, publish trusted SHA-256 checksums and require checksum verification. 4. Vendor the required smoke-test scripts into the reviewed skill package when licensing and maintenance constraints permit. 5. Require source review of the resolved revision before running any script. 6. Execute the scripts in a sandbox or isolated virtual machine with minimal filesystem and network access. 7. Remove unrelated credentials and secrets from the subprocess environment. 8. Provide `VISIO_BRIDGE_TOKEN` only to the verified operation that requires it, and constrain the token to the minimum necessary permissions. 9. Document the expected repository owner, immutable revision, verification procedure, and failure behavior. 10. Abort execution if commit, signature, or checksum verification fails.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to clone an external GitHub repository and execute multiple local Python scripts, but it provides no warning that these actions run untrusted code and may modify the local system or require sensitive environment variables. In an agent setting, this is dangerous because it normalizes code execution from a third-party repo during onboarding, increasing the risk of supply-chain compromise, unintended system changes, or secret exposure if the repository or scripts are malicious or later become compromised.

Static analysis

No suspicious patterns detected.