Security audit

Project Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plausible coding-agent orchestrator, but it exposes powerful agent execution, code indexing, chat history, and database controls without adequate access controls.

Review this before installing. Use it only in an isolated, trusted local environment unless it is hardened first: bind services to loopback, add authentication and per-user authorization, replace all default credentials, restrict sync/watch and chat cwd to an explicit workspace, disable symlink escapes, remove permission-bypass agent execution, and pin the git dependency.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/chat/manager.rs:237
Finding: Unauthenticated Remote Launch of Permission-Bypassed Claude Code Agents
Content: View full analysis
, ) -> ClaudeCodeOptions { let mcp_path = self.config.mcp_server_path.to_string_lossy().to_string(); let mut env = HashMap::new(); env.insert("NEO4J_URI".into(), self.config.neo4j_uri.clone()); env.insert("NEO4J_USER".into(), self.config.neo4j_user.clone()); env.insert("NEO4J_PASSWORD".into(), self.config.neo4j_password.clone()); env.insert( "MEILISEARCH_URL".into(), self.config.meilisearch_url.clone(), ); env.insert( "MEILISEARCH_KEY".into(), self.config.meilisearch_key.clone(), ); let mcp_config = McpServerConfig::Stdio { command: mcp_path, args: None, env: Some(env), }; ...[truncated 2643 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/chat/manager.rs:245
Finding: Database Secrets Are Injected into a Permission-Bypassed Agent Environment
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/api/handlers.rs:454
Finding: Unauthenticated Arbitrary-Directory Source Ingestion with Symlink Following
Content: View full analysis
, Json(req): Json, ) -> Result, AppError> { let path = std::path::Path::new(&req.path); let result = state.orchestrator.sync_directory(path).await?; Ok(Json(SyncResponse { files_synced: result.files_synced, files_skipped: result.files_skipped, errors: result.errors, })) } ``` ```rust // src/orchestrator/runner.rs:229-235 for entry in WalkDir::new(dir_path) .follow_links(true) .into_iter() .filter_map(|e| e.ok()) .filter(|e| e.file_type().is_file()) { ``` ```rust // src/orchestrator/runner.rs:288-318 pub async fn sync_file_for_project( &self, path: &Path, project_id: Option, project_slug: Option<&str>, ) -> Result { let content = tokio::fs::read_to_string(path) .await .context("Failed to read file")?; let path_str = path.to_string_lossy().to_string(); if let Some(existing) = self.state.neo4j.get_file(&path_str).await? { use sha2::{Digest, Sha256}; let mut hasher = Sha256::new(); hasher.update(content.as_bytes()); let hash = hex::encode(hasher.finalize()); if existing.hash == hash { return Ok(false); } } let parsed = { let mut parser = self.parser.write().await; parser.parse_file(path, &content)? }; self.store_parsed_file_for_project(&parsed, project_id) .await?; ``` ### Technical Analysis The `/api/sync` endpoint accepts an arbitrary path and passes it directly into recursive directory travers ...[truncated 1640 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: src/api/chat_handlers.rs:60
Finding: Unauthenticated Conversation Disclosure and Persistent Session Memory Poisoning
Content: View full analysis
, Path(session_id): Path, Json(client_msg): Json, ) -> Result, AppError> { let chat_manager = state .chat_manager .as_ref() .ok_or_else(|| AppError::Internal(anyhow::anyhow!("Chat manager not initialized")))?; let message = match &client_msg { ClientMessage::UserMessage { content } => content.clone(), ClientMessage::PermissionResponse { allow, reason } => { format!( "Permission {}: {}", if *allow { "granted" } else { "denied" }, reason.as_deref().unwrap_or("") ) } ClientMessage::InputResponse { content } => content.clone(), }; if !chat_manager.is_session_active(&session_id).await { chat_manager .resume_session(&session_id, &message) .await .map_err(AppError::Internal)?; } else { chat_manager .send_message(&session_id, &message) .await .map_err(AppError::Internal)?; } ``` ```rust // src/chat/manager.rs:494-498 if let Some(ref mm) = memory_manager { let mut mm = mm.lock().await; mm.record_user_message(&prompt); } ``` ```rust // src/chat/manager.rs:626-645 if let Some(ref mm) = memory_manager { let assistant_text = assistant_text_parts.join("" ...[truncated 2274 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/api/routes.rs:14
Finding: Permissive Cross-Origin Access to Unauthenticated Administrative APIs
Content: View full analysis
Router { let cors = CorsLayer::new() .allow_origin(Any) .allow_methods(Any) .allow_headers(Any); ``` ```rust .layer(TraceLayer::new_for_http()) .layer(cors) .with_state(state) ``` ### Technical Analysis The server permits every web origin, HTTP method, and request header. Because the administrative API does not otherwise require authentication, an attacker-controlled website can issue cross-origin requests to a locally or remotely reachable orchestrator service. CORS is not an authentication mechanism. In this case, however, the wildcard policy removes the browser's same-origin protection and makes drive-by exploitation substantially easier. ### Attack Path 1. A victim runs the orchestrator on a machine where port 8080 is reachable from the browser. 2. The victim visits an attacker-controlled website. 3. JavaScript on that website sends cross-origin requests to the orchestrator. 4. The wildcard CORS policy permits those requests and allows the malicious origin to read responses. 5. The website creates agent sessions, submits messages, initiates filesystem sync, reads project data, or invokes destructive operations. ### Impact Assessment A malicious webpage can exercise the same unauthenticated API privileges as a direct network attacker. The resulting scope includes: - Launching permission-bypassed agent sessions. - Reading chat, project, task, note, and indexed-code data. - Triggering arbitrary-directory synchronization. - Starting filesystem watchers. - Modifying or deleting persistent records. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: docker-compose.yml:5
Finding: Published Backend Ports Use Hardcoded Repository-Known Credentials
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: Cargo.toml:68
Finding: Security-Critical SDK Is Loaded from an Unpinned Git Branch
Content: View full analysis
Remediation: View remediation
", features = ["memory"] } ``` 2. Commit and enforce `Cargo.lock` for application builds. 3. Require dependency changes to pass code review and security testing. 4. Prefer a verified crates.io release with checksum-backed resolution when available. 5. Record upstream provenance and verify signed tags or commits. 6. Use `cargo-deny`, dependency auditing, and reproducible CI builds. 7. Review the SDK specifically for subprocess environment inheritance, permission handling, and memory storage behavior. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (229)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLAUDE.md (reported line 323)May include surrounding context.
md
- `POST /api/plans` - Create plan (with optional `project_id` to associate with project) - `GET /api/plans/{id}` - Get plan details - `PUT /api/plans/{id}/project` - Link plan to a project - `DELETE /api/plans/{id}/project` - Unlink plan from project - `GET /api/plans/{id}/next-task` - Get next available task - `GET /api/plans/{id}/dependency-graph` - Get task dependency graph for visualization - `GET /api/plans/{id}/critical-path` - Get longest dependency chain

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLAUDE.md (reported line 335)May include surrounding context.
md
### Task Dependencies - `POST /api/tasks/{id}/dependencies` - Add dependencies after task creation - `DELETE /api/tasks/{id}/dependencies/{dep_id}` - Remove a dependency - `GET /api/tasks/{id}/blockers` - Get tasks blocking this task (uncompleted dependencies) - `GET /api/tasks/{id}/blocking` - Get tasks blocked by this task

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLAUDE.md (reported line 378)May include surrounding context.
md
### Constraints - `GET /api/plans/{id}/constraints` - Get plan constraints - `POST /api/plans/{id}/constraints` - Add constraint (performance, security, style, etc.) - `DELETE /api/constraints/{id}` - Remove constraint ### Code Exploration - `GET /api/code/search?q=...` - Semantic search (with ranking scores)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLAUDE.md (reported line 400)May include surrounding context.
md
- `POST /api/notes` - Create note (project_id, note_type, content, importance, tags) - `GET /api/notes/{id}` - Get note details - `PATCH /api/notes/{id}` - Update note (content, importance, status, tags) - `DELETE /api/notes/{id}` - Delete note - `GET /api/notes/search?q=...` - Semantic search across notes - `GET /api/notes/context` - Get notes for entity (direct + propagated via graph) - `GET /api/notes/needs-review` - List stale/needs_review notes

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLAUDE.md (reported line 409)May include surrounding context.
md
- `POST /api/notes/{id}/invalidate` - Mark note as obsolete - `POST /api/notes/{id}/supersede` - Replace with new note - `POST /api/notes/{id}/links` - Link note to entity - `DELETE /api/notes/{id}/links/{type}/{entity}` - Unlink note from entity - `GET /api/projects/{id}/notes` - List notes for a project **Note Types:** `guideline`, `gotcha`, `pattern`, `context`, `tip`, `observation`, `assertion`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLAUDE.md (reported line 427)May include surrounding context.
md
- `POST /api/workspaces` - Create workspace - `GET /api/workspaces/{slug}` - Get workspace by slug - `PATCH /api/workspaces/{slug}` - Update workspace - `DELETE /api/workspaces/{slug}` - Delete workspace - `GET /api/workspaces/{slug}/overview` - Overview with projects, milestones, resources, progress **Workspace-Project Association:**

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLAUDE.md (reported line 433)May include surrounding context.
md
**Workspace-Project Association:** - `GET /api/workspaces/{slug}/projects` - List projects in workspace - `POST /api/workspaces/{slug}/projects` - Add project to workspace - `DELETE /api/workspaces/{slug}/projects/{id}` - Remove project from workspace **Workspace Milestones (cross-project):** - `GET /api/workspaces/{slug}/milestones` - List workspace milestones

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLAUDE.md (reported line 440)May include surrounding context.
md
- `POST /api/workspaces/{slug}/milestones` - Create workspace milestone - `GET /api/workspace-milestones/{id}` - Get milestone with tasks - `PATCH /api/workspace-milestones/{id}` - Update milestone - `DELETE /api/workspace-milestones/{id}` - Delete milestone - `POST /api/workspace-milestones/{id}/tasks` - Add task from any project - `GET /api/workspace-milestones/{id}/progress` - Get completion progress

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLAUDE.md (reported line 448)May include surrounding context.
md
- `GET /api/workspaces/{slug}/resources` - List resources - `POST /api/workspaces/{slug}/resources` - Create resource reference - `GET /api/resources/{id}` - Get resource details - `DELETE /api/resources/{id}` - Delete resource - `POST /api/resources/{id}/projects` - Link project (implements/uses) **Components & Topology:**

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLAUDE.md (reported line 455)May include surrounding context.
md
- `GET /api/workspaces/{slug}/components` - List components - `POST /api/workspaces/{slug}/components` - Create component - `GET /api/components/{id}` - Get component - `DELETE /api/components/{id}` - Delete component - `POST /api/components/{id}/dependencies` - Add dependency - `DELETE /api/components/{id}/dependencies/{dep_id}` - Remove dependency - `PUT /api/components/{id}/project` - Map to project

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLAUDE.md (reported line 457)May include surrounding context.
md
- `GET /api/components/{id}` - Get component - `DELETE /api/components/{id}` - Delete component - `POST /api/components/{id}/dependencies` - Add dependency - `DELETE /api/components/{id}/dependencies/{dep_id}` - Remove dependency - `PUT /api/components/{id}/project` - Map to project - `GET /api/workspaces/{slug}/topology` - Full topology graph

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLAUDE.md (reported line 523)May include surrounding context.
Session management:

GET /api/chat/sessions — List sessions (pagination, project_slug filter)

GET /api/chat/sessions/{id} — Get session details

DELETE /api/chat/sessions/{id} — Delete session (closes active process)

SSE Event types:

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLAUDE.md (reported line 546)May include surrounding context.
md
### Sync & Watch - `POST /api/sync` - Manual sync - `POST /api/watch` - Start auto-sync - `DELETE /api/watch` - Stop auto-sync ### Meilisearch Maintenance - `GET /api/meilisearch/stats` - Get code index statistics

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CLAUDE.md (reported line 550)May include surrounding context.
md
### Meilisearch Maintenance - `GET /api/meilisearch/stats` - Get code index statistics - `DELETE /api/meilisearch/orphans` - Delete documents without project_id ## Development Guidelines

MCP Config Access

High

Category: Agent Snooping
Confidence: 95% confidence
Finding: The README instructs users to place live service credentials directly into an MCP client configuration file under a home-directory path, including example passwords and API keys. In agent-integrated environments, such config files may be readable by local tools, plugins, backup systems, or other agents, making credential exposure and unauthorized access to the code graph and search backend more likely.
Content: Scanner excerpt · README.md (reported line 38)May include surrounding context.
2. Configure your AI tool

Add to your MCP configuration (e.g., ~/.claude/mcp.json):

json
{

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a full AI agent orchestrator with specific subsystems: Neo4j, Meilisearch, and Tree-sitter, intended to coordinate multiple coding agents. The supplied code chunk does not implement orchestration or any of those named capabilities. It is only a helper script that queries two HTTP endpoints on an existing orchestrator service to retrieve JSON context or a generated prompt for a task. This is materially narrower than the declared purpose, so the description does not accurately represent the behavior of the provided code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code chunk is narrowly a Bash wrapper around orchestrator REST endpoints for managing plans and tasks. While this partially aligns with the 'shared context and plans' aspect of orchestration, it does not demonstrate the prominently declared capabilities: Neo4j knowledge graph integration, Meilisearch search, or Tree-sitter parsing. Its actual role is a plan-management client script, not a full AI agent orchestrator. Therefore the description materially overstates and mischaracterizes what this specific code chunk does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The declared description presents the skill as a broad AI agent orchestrator with Neo4j, Meilisearch, and Tree-sitter for coordinating multiple coding agents. The supplied code chunk is much narrower and materially different: it defines Axum handlers for chat-related endpoints, including creating/resuming sessions, sending messages, interrupting, SSE subscriptions, message history retrieval, and session CRUD. While Neo4j appears in session listing/get/delete operations, that is only for chat session storage/retrieval. There is no evidence in this chunk of Meilisearch integration, Tree-sitter parsing, knowledge-graph-driven orchestration, or multi-agent coordination. This is a substantive description/behavior mismatch rather than a mere partial implementation detail.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents the skill as an AI agent orchestrator centered on coordinating multiple coding agents using Neo4j, Meilisearch, and Tree-sitter. The supplied code chunk is instead narrowly focused on REST-style handlers for a knowledge notes API. Its primary behavior is managing notes and their lifecycle, including search, contextual retrieval, linking to entities, propagation, confirmation, invalidation, supersession, and staleness updates. While there is some thematic overlap with a knowledge graph/orchestrator system and one Neo4j-backed lookup, the concrete functionality here is not agent coordination or planning. The mismatch is material because the code’s primary purpose is a note-management API subsystem, and key declared technologies/capabilities like Meilisearch search integration and Tree-sitter parsing are not represented in this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied code chunk is a utility module for common HTTP/API query parameters and paginated responses. Its concrete behavior is limited to parsing and validating pagination/filter inputs and formatting paginated outputs. This is materially different from the declared purpose of an AI agent orchestrator with graph/search/parser integrations. None of the advertised systems or capabilities appear in the code, so the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The declared description emphasizes an AI agent orchestration system with Neo4j, Meilisearch, and Tree-sitter, intended for coordinating coding agents on complex projects. The supplied code chunk does not implement agent coordination, search, parsing, or planning behavior. Instead, it is a set of backend API handlers for managing domain entities in a workspace system: workspaces, projects, milestones, resources, components, dependencies, and topology. While use of a Neo4j-backed orchestrator is consistent with part of the description, the primary behavior here is CRUD/API administration over project metadata, not AI orchestration. This is a material description-behavior mismatch for this chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description emphasizes an AI agent orchestration system with knowledge graph, search, and parsing capabilities for coordinating coding agents. The supplied code chunk instead provides infrastructure for WebSocket-based real-time event delivery to clients. Its primary behavior is accepting a WebSocket upgrade, subscribing to an event bus, filtering events, serializing them to JSON, and maintaining the socket with ping/pong handling. Those behaviors are not represented in the declared description, and the headline capabilities named in the description are not present in this code chunk. This is a material description-to-behavior mismatch rather than a mere supporting implementation detail.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The declared description emphasizes a general multi-agent coding orchestrator with Neo4j, Meilisearch, and Tree-sitter parsing. This code chunk instead focuses on managing interactive Claude Code chat sessions: spawning/resuming CLI clients, streaming responses, handling interrupts, maintaining active session state, and persisting chat metadata/history. It does use Neo4j and Meilisearch for context and memory, which partially aligns with the description, but there is no evidence here of Tree-sitter parsing or explicit coordination among multiple coding agents. The primary purpose is materially different: chat session orchestration for a single LLM/CLI workflow rather than a broader multi-agent orchestrator.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description centers on a multi-agent coding orchestrator backed by Neo4j, Meilisearch, and Tree-sitter. The supplied code chunk instead exposes a chat module with streaming/session-oriented conversational capabilities. These are materially different primary purposes. While a chat interface could be a supporting component in a larger orchestrator, this specific chunk does not reflect the declared graph/search/parsing/orchestration functionality and instead advertises a different subsystem.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The supplied code chunk does not implement an AI agent orchestrator or show behavior related to coordinating multiple coding agents, searching with Meilisearch, or parsing with Tree-sitter. Instead, it is a type-definition module for a chat subsystem, including request/response/event enums and session metadata with serde support and tests. The mention of Neo4j appears only in a comment on persisted session metadata, not as actual graph operations. This is a materially different primary purpose from the declared description, so the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T02 · Agent Memory Poisoning

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

MCP Config Access

2. Configure your AI tool

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Static analysis