Security audit

Vibe Coding Rules

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed developer-workflow skill that automates code checks, tests, changelogs, and project setup, with notable but purpose-aligned workspace side effects.

Install only in a development workspace where you are comfortable with automated project-file edits. Review the install script target paths, keep the shareContact phone field empty unless you intentionally want it published in generated changelogs, and disable or avoid screenshot/OCR testing on pages that may display secrets or private user data.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (19)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The changelog skill is authorized to record changes, but these steps expand its behavior into scanning prior edits, mutating rule files, updating observation pools, and writing growth logs. That scope creep creates unintended write capabilities across the repository, which can let the agent alter governance and review artifacts under the pretext of changelog generation.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The anti-bloat workflow performs broad repository hygiene actions such as demoting rules, pruning observations, and compacting archives, none of which are necessary to write a changelog. This increases the blast radius of the skill and allows silent modification or deletion of policy/history data from auxiliary files.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The one-click share export adds promotional output and external-contact-oriented content unrelated to changelog writing. This can cause the agent to inject marketing or data-sharing text into project artifacts, creating an avenue for unauthorized content insertion and possible disclosure of internal process details.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill reads contact information from configuration and reproduces it in generated output even though a changelog function does not need personal or organizational contact data. This violates data minimization and can leak sensitive phone numbers or project-identifying metadata into committed files or shared artifacts.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: Automatically editing README.md or OVERVIEW.md after a version bump extends the skill from changelog writing into general documentation maintenance. That permits additional file modifications outside the user's likely expectation and can be abused to alter prominent project documents without a distinct authorization boundary.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger logic uses very broad natural-language examples for detecting a 'new project', which can easily match ordinary conversation and cause the agent to inject unsolicited workflow/setup prompts. In an agent setting, overbroad activation is a control-boundary problem: it can steer user interactions unexpectedly, create prompt churn, and normalize automatic behavior without clear opt-in.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly describes automatically opening a browser, taking screenshots, performing OCR, and auto-updating breadcrumbs/changelogs, but it does not clearly warn users that these actions may capture visible local application data or modify repository files. In an agent context, this can lead to unintended data exposure and silent workspace changes, especially when users assume the tooling is purely advisory rather than actively observing UI state and writing metadata.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The installation guidance tells users to say a broad natural-language trigger, '初始化流水线', after which the AI will '自动检测项目并配置'. This creates an unconstrained invocation path that can cause the agent to perform project-wide inspection and modifications without explicit scoping, confirmation, or a preview of intended actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill advertises automatic project detection and configuration but does not warn users that invoking initialization may modify project files or create pipeline artifacts. In an agentic environment, silent configuration changes can alter build behavior, commit unwanted files, or disrupt existing tooling, especially for inexperienced users targeted by this skill.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The web-testing feature explicitly includes screenshots and OCR, but the description does not warn that automated testing may capture sensitive on-screen content, tokens, user data, or proprietary UI states. In many development environments, screenshot and OCR artifacts can persist in logs or output directories and become an unintended data exposure channel.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The skill instructs the agent to write or append files automatically but does not require a user-facing notice that filesystem changes will occur. While not inherently malicious, this reduces transparency and increases the chance of surprising or unauthorized repository edits during routine use.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The version-sync section explicitly expands writes to README/OVERVIEW but does not warn the user that additional project documentation may be changed. This weakens informed consent and can lead to unnoticed edits in high-visibility files that users did not intend to touch.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger conditions are broad enough to activate on common phrases like starting a new project, which can cause the skill to run in contexts where the user did not clearly consent to pipeline initialization. Because this skill performs file creation, configuration writes, and memory modification later in the workflow, overbroad activation increases the chance of unintended side effects.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This step directs the agent to create project structures and files without first requiring an explicit warning or confirmation that local files will be created or modified. In an agent setting, silent filesystem changes can surprise users, affect existing workspaces, or overwrite expected layouts, making the behavior unsafe even if intended to help.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Copying files from a global template into a project directory without an explicit warning or overwrite policy can introduce unexpected local changes and propagate stale or unsafe template content. The risk is elevated because the source is a global install path, which may vary across environments and may not be transparent to the user.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Appending to `.codebuddy/memory/MEMORY.md` modifies persistent user memory without a clear disclosure or consent step. Persistent memory changes are more sensitive than ordinary project edits because they can influence future agent behavior across sessions and may be difficult for users to notice or reverse.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill mandates automatic insertion and updating of breadcrumb comments in every modified file, including cross-file references and historical annotations, without requiring user confirmation or warning about modifying unrelated project files. In an agent context, this can cause integrity-impacting changes, metadata leakage, and unintended edits to sensitive or generated files simply as a side effect of any code change.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger conditions include very broad natural-language phrases like "test" and "verify page", which can cause the skill to activate in situations the user did not clearly intend. Because this skill executes browser automation and test scripts against a configured target, unintended invocation can consume resources, hit live systems, or run against sensitive environments if pipeline values are misconfigured.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The rule explicitly instructs the system to copy a configured phone number into changelog output when certain conditions are met. Even though this is opt-in, changelogs are commonly committed, shared, or exported, so embedding contact data can unintentionally disclose personal or organizational information beyond the intended audience.

Static analysis

No suspicious patterns detected.