Class Seven

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:07 AM UTC
• Version: 1.0.0

Overview

This multi-agent workflow skill is coherent, but it needs review because it can route sensitive code or logs to external models and recommends unsafe remote installer commands and persistent agent configuration changes.

Review this skill before installing. It is not clearly malicious, but use it only with explicit approval for external model calls, sanitize logs and repository content before sharing, avoid pipe-to-execute installer commands unless you independently trust and verify them, and treat the suggested Claude/Kimi config changes as persistent changes to future agent behavior.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/tools-guide.md:131

Finding

Unverified Remote PowerShell Installers Are Downloaded and Executed

Content

View full analysis

Remediation

View remediation

" -OutFile "./installer.ps1" ``` 4. Publish and require verification of a trusted SHA-256 checksum: ```powershell Get-FileHash "./installer.ps1" -Algorithm SHA256 ``` 5. Where applicable, require validation of the vendor's Authenticode signature: ```powershell Get-AuthenticodeSignature "./installer.ps1" ``` 6. Tell users to inspect the downloaded script before execution. 7. Run installation with the least-privileged account possible and only request elevation if a documented installation step requires it. 8. Prefer signed package-manager distributions with pinned package names and versions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/examples.md:65

Finding

Production Logs and Proprietary Project Content May Be Forwarded to External Models Without Data Controls

Content

View full analysis

Identify root cause and provide fix strategy""", model="anthropic/claude-sonnet-4-5", label="debugger-500" ) ``` Pull-request content forwarding to multiple external models: ```python # Fetch PR content first pr_content = fetch_pr(42) reviews = [ sessions_spawn( task=f"Review PR against requirements: {pr_content}", model="kimi-coding/k2p5", label="review-pm" ), sessions_spawn( task=f"Review design patterns: {pr_content}", model="anthropic/claude-sonnet-4-5", label="review-arch" ), sessions_spawn( task=f"Review tests and edge cases: {pr_content}", model="kimi-coding/k2p5", label="review-test" ) ] consolidated = consolidate_reviews(reviews) ``` Architecture and implementation content forwarded through the pipeline: ```python # Phase 2: Architect design = sessions_spawn( task=f"""As Architect, design system for: {prd.output} Include: tech stack, data models, API specs""", model="anthropic/claude-sonnet-4-5", label="arch-design" ) # Phase 3: Developer code = sessions_spawn( task=f"""As Developer, implement: {design.output} Follow coding standards, add comments""", model="kimi-coding/k2p5", label="dev-impl" ) # Phase 4: Tester qa = sessions_spawn( task=f"""As Tester, verify: Code: {code.output} Against: {prd.acceptance_criteria} Include: test cases, bug report if any""", model="kimi-coding/k2p5", label="test-qa" ) ``` ### Technical Analysis The examples ...[truncated 2980 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

- Tool integration guide: See [references/tools-guide.md](references/tools-guide.md)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/tools-guide.md (reported line 167)May include surrounding context.

Both tools should be configured for Windows/PowerShell:

json

// ~/.claude/settings.json
{
  "systemPrompt": "Use Windows PowerShell commands. Never use: &&, grep, curl, cat, rm -rf, mkdir -p"
}

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description is very broad and frames the skill as applicable to many complex development tasks without strong activation boundaries. In an agent ecosystem, overly broad invocation guidance can cause the skill to be selected in situations where multi-agent orchestration, tool use, or code-modifying behavior is unnecessary, increasing the chance of unsafe delegation, excessive permissions use, or unintended execution paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The 'When to Use' section lists broad categories like debugging, code review, and end-to-end delivery, but does not define constraints, prerequisites, or non-applicable scenarios. This makes over-activation more likely, especially because the skill orchestrates multiple specialized agents and tool choices, which can amplify mistakes, expand attack surface, and bypass more narrowly scoped workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example explicitly sends production logs to an external model for analysis, but provides no warning, sanitization step, or approval gate before transmitting potentially sensitive operational data. Production logs commonly contain secrets, personal data, internal URLs, tokens, stack traces, or other confidential context, so this can cause unintended data exfiltration to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide instructs users to execute remote PowerShell install scripts via irm ... | iex, which downloads and immediately executes code without verification, pinning, or integrity checks. In a multi-agent development workflow, this is especially risky because users may copy these commands into privileged environments, enabling supply-chain compromise or arbitrary code execution if the endpoint or delivery path is tampered with.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide states tools should be configured for Windows/PowerShell and hard-codes system prompts instructing the agent to use Windows PowerShell commands and never use common Unix-style commands. This is a language/locale/platform constraint expressed as a blanket policy rather than an optional or justified environment-specific preference.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/tools-guide.md (reported line 169)May include surrounding context.

json

// ~/.claude/settings.json
{
  "systemPrompt": "Use Windows PowerShell commands. Never use: &&, grep, curl, cat, rm -rf, mkdir -p"
}

// ~/.kimi/config.toml