Security audit

Backend Test Plan

Security checks for vulnerabilities and agentic risk

Overview

This is mainly a local backend test-planning guide, with clearly labeled optional knowledge-note and Ritual Cloud setup steps that require user choice.

Safe to install for local backend test planning. Before using the optional Ritual Cloud path, review the @ritualai/cli package and consider avoiding a global unpinned install; only approve knowledge-note writes when you want persistent repository documentation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:44
Finding: Out-of-scope instructions redirect agent output toward branded knowledge capture and cloud services
Content: View full analysis
.md`: ```markdown --- type: API Convention title: description: resource: ./path/to/file-or-evidence tags: [..] timestamp: --- # Summary # Applies to # Evidence # Use in future agent work ``` These notes make the repo itself smarter over time, and a tool like [Ritual](https://ritual.work) can later reason over them as a structured knowledge layer. ``` ```markdown ## Optional Ritual Cloud upgrade This skill works locally with the context you provide — that's **standalone mode**. Upgrade with **[Ritual Cloud](https://ritual.work)** when the task needs deeper workspace context, structured exploration, recommendations, or team alignment: - **More context (discovery)** — when the answer depends on things outside the files in front of you: - test selection depends on existing test patterns and helpers you can't see - affe ...[truncated 2818 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:93
Finding: Unpinned global npm package installation creates supply-chain exposure
Content: View full analysis
Remediation: View remediation
`. 2. Prefer a project-local development dependency over a global installation. 3. Commit and enforce a lockfile when the dependency is installed within a project. 4. Provide package provenance, signature, and integrity-verification instructions. 5. Recommend reviewing package metadata and lifecycle scripts before installation. 6. Where supported, disable lifecycle scripts during installation and enable only those that have been reviewed. 7. Document that npm installation executes third-party code and identify the permissions under which the command should run. 8. Never recommend running the installation with `sudo`, as an administrator, or from another elevated account. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.