Security audit

Vibe Coding Rules

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed coding workflow tool, but it needs Review because it persists agent instructions, auto-grows blocking rules, and authorizes broad file/package operations without enough runtime control.

Install only in repositories where you want this workflow to modify project files and influence future agent behavior. Before enabling it, require previews for .ai-pipeline changes, breadcrumb/file-header edits, changelog writes, and .codebuddy memory updates; keep shareContact.phone empty unless you intentionally want it published; pin package versions and avoid direct rm/git push/npm/npx execution without explicit review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: pipeline-init/SKILL.md:86
Finding: Persistent Agent Memory and Auto-Grown Mandatory Rule Injection
Content: View full analysis
This step handles self-growing system generated Trust-Tiered rules. Only executes when project `.ai-pipeline/` exists. 1. **Read observation pool**: `read_file("references/observations.md")` - Check if any Tier 0 observation entries relate to this change - If related, record "this pattern has been observed N times before" 2. **Read auto-grown rules**: Check `[SOFT]` and `[HARD]` marked rules at the end of `self-check-full.md` in the [Auto-Grown Rules Zone] - `[HARD]` rules → mandatory block, must fix - `[SOFT]` rules → warn, suggest fix but skippable 3. **User resistance demotion**: If user explicitly says "ignore this rule" or "skip this": - Record demotion event in `growth-log.md` - `[HARD]` → demote to `[SOFT]` (confidence -2) - `[SOFT]` → demote back to `observations.md` observation pool (confidence -2) ``` ### Technical Analysis The init ...[truncated 2259 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: changelog/SKILL.md:130
Finding: Conditional Promotional Content Injection into Project Changelogs
Content: View full analysis
**[HARD] Rule Name**: Rule description > Trigger: XXX > Correct Pattern: XXX > Confidence: N (consistently triggered N times) --- These rules come from the **Vibe Coding Rules V2.2** self-growing system. 📱 Share: {{pipeline.selfGrowth.shareContact.phone}} ({{pipeline.selfGrowth.shareContact.projectName}}) ``` **Format requirements**: - Only list rules promoted or triggered as [HARD] this session - One line per rule with brief description + confidence - Phone and project name read from `pipeline.json` `selfGrowth.shareContact` - **If phone is empty → skip this block entirely** (opt-in privacy design) - If no [HARD] rule changes this session → skip regardless ``` ### Technical Analysis The Skill contains an instruction to append fixed product branding and contact details to a project changelog when a `[HARD]` rule is generated and `shareContact.phone` is configured. The default configuration leaves the phone field empty, so the behavior is not active by default. However, once configured, the content is injected as part of the mandatory changelog workflow rather than being generated only in response to a separate sharing request. This alters a task artifact for a promotional purpose unrelated to the technical substance of the underlying code change. Because ...[truncated 1362 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: safe-terminal-executor/SKILL.md:9
Finding: Unpinned Third-Party Installation and Direct Package-Runner Execution
Content: View full analysis
30s | **Forbidden** — split or generate script | | `git add/commit/push` | Execute directly | ``` From `web-testing/SKILL.md:76-84`: ```markdown If dependencies are missing: ```bash npm install playwright npx playwright install chromium npm install tesseract.js sharp ``` ``` From `install.sh:70-72`: ```bash echo " 2. Install optional deps (if needed)：" echo " npm install playwright" echo " npx playwright install chromium" ``` ### Technical Analysis The Skill authorizes agents to execute `npm` and `pip` installation commands directly and recommends package names without exact versions, integrity hashes, lockfile enforcement, registry restrictions, or lifecycle-script controls. `npm install playwright`, `npm install tesseract.js sharp`, and package-runner operations such as `npx` resolve content from an external package ecosystem at execution time. The installed version and effective package content can therefore differ from what was available when the Skill was audited. Package installation can execute lifecycle scripts with the permissions of the invoking user. A compromised upstream package, registry account, dependency tree, registry configuration, or name-resolution environment could consequently execute code locally. The audit found n ...[truncated 1410 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill content and prescribed user-facing prompt are entirely in Chinese, which indicates a fixed language behavior. There is no indication that the user can choose another language or that the locale restriction is intentional and justified for a region-specific use case.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The auto-trigger condition is defined with broad natural-language examples like '我要做一个XX' and '新建项目', which can match ordinary discussion rather than an explicit request to initialize tooling. In an agent skill, this can cause unsolicited workflow injection, unexpected file creation, or confusing prompt steering, especially because the text says the agent 'must ask' whenever it detects such intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly promotes automatic browser opening, screenshot capture, OCR processing, and automatic file-header modification, but does not clearly warn users that local files will be changed and page contents may be captured and processed. In an agent-skill context, these are side-effecting operations that can expose sensitive on-screen or in-browser data and alter repositories without informed user consent, making the omission security-relevant rather than purely documentation-related.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README advertises one-click initialization that automatically creates a pipeline and quality infrastructure, but does not warn that running it may create or modify project files. For an agent-oriented bootstrap tool, this can lead users to approve broad workspace changes without understanding scope, increasing the risk of unintended file modification, configuration drift, or insertion of automation that later performs additional privileged actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The phrase instructing the agent to act on a short natural-language trigger ('初始化流水线') is broad and lacks explicit scope, consent, or environmental constraints. In an agentic coding environment, this can cause the assistant to begin project detection and configuration actions without confirming what repository, files, or commands are allowed, increasing the risk of unintended modifications or command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill directs the agent to create or modify changelog and overview-related files automatically, but does not require a user-facing confirmation or warning before performing those writes. In an agentic environment, silent file modification is risky because users may invoke what appears to be a documentation helper while it changes multiple repository files as side effects.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill goes beyond changelog generation and adds a share-export feature that reads a configured phone number and injects it into generated output. This creates an unnecessary data exposure path for contact information, and because it is embedded into an automated workflow, users may disclose private or organizational contact details without realizing a changelog step is performing promotion/export behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill reads a configured phone number from pipeline settings and includes it in exported share text without a prominent privacy warning or explicit consent at time of use. Even if the field is opt-in in configuration, the automated publication path can still leak sensitive contact details into project artifacts or shared outputs unexpectedly.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documented purpose of the skill is to write changelog entries, but it also instructs the agent to modify README.md or OVERVIEW.md during version bumps. This scope expansion increases the chance of unintended file modifications in user-visible project documentation, violating least surprise and making the skill capable of altering files outside its expected boundary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill declares itself as 'mandatory' and 'forced active' for broad triggers such as any code modification, bug report, new feature, or refactor. That wide activation scope can unintentionally override normal conversational behavior and cause the agent to apply this workflow in many routine situations, increasing prompt-scope creep and the chance of conflicting with higher-priority user or system instructions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The installer recursively creates directories and copies or overwrites files with -Force and no confirmation, backup, or dry-run behavior. In a developer environment, this can silently replace existing skill files or project-local .ai-pipeline content, causing configuration loss or unexpected behavior, especially if run from the wrong directory.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest’s user-facing name and descriptions are predominantly in Chinese, with no indication that the skill is region-specific or that users can opt into another language. Under the policy, forcing a specific language without opt-in is a natural-language policy concern applicable to all file types.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad enough to activate on ordinary conversation about starting a project, which can cause the skill to run in contexts where the user did not explicitly request initialization actions. Because this skill later performs environment checks and prepares file-writing steps, overbroad activation increases the chance of unintended side effects and consent bypass.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This section instructs the agent to create project structure and files but does not require a user-facing warning or explicit confirmation before filesystem changes. In an agent setting, silent writes can modify repositories, introduce unexpected files, or create persistent configuration without the user's informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs copying template files from a global path, overwriting pipeline artifacts, and appending persistent content to .codebuddy/memory/MEMORY.md without an explicit warning or approval checkpoint. This is more dangerous than ordinary scaffolding because it combines multiple persistent writes, introduces content from an external template source, and can alter future agent behavior through memory seeding.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire checklist and user-facing installation guidance are written only in Chinese, including wording aimed at end users such as '普通人也能看得懂'. The file does not offer an alternative language or state that the skill is intentionally limited to Chinese-speaking users, which can violate a language/locale choice policy.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The checklist recommends executing npx electron --version without pinning a package version. npx may fetch and execute the latest package from the registry if Electron is not already installed locally, which creates a supply-chain execution risk and reduces reproducibility. In an agent skill that may be followed automatically or semi-automatically, even a version-check command can trigger unreviewed code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The file recommends npx playwright --version without a pinned version. If Playwright is absent, npx can download and run the current registry package, exposing users to unintended remote code execution from the package supply chain and making behavior dependent on mutable upstream state. Because this skill is designed as an operational workflow, users or agents may run the command as-is, increasing practical risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The configuration sets language to zh-CN and states that all generated docs use this language. Although other languages are listed as available, this file does not show an explicit user opt-in or selection mechanism here, so it reads as a forced locale policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly permits direct execution of file operations including potentially destructive actions such as copy and rm without any confirmation, path validation, or safety constraints. In an agentic coding context, this creates a real risk of accidental deletion or overwriting of repository, system, or user files if the agent misclassifies scope or receives ambiguous instructions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s header comments and runtime messages are written entirely in Chinese, which imposes a specific language on users. Per the policy, forcing a language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script emits timeout and JSON parsing errors only in Chinese, and similar localized output appears elsewhere in execution. This creates a language/locale restriction in the operational experience without user choice or documented justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill says it "must execute" when broad events occur such as "Modifying core task-link code" or "Modifying Express routes," but it does not define precise boundaries, exclusions, or concrete examples for what counts. These common development activities could cause over-invocation because the trigger scope is not narrowly constrained.
Content: No source excerpt is available for this finding.