Auto Iterate

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 1.0.0

Overview

This skill is an autonomous optimizer, but it can run shell commands indefinitely and use destructive git rollback in ways that may discard unrelated work.

Install only if you are comfortable giving the agent unattended authority to edit code, run shell commands, create commits, and roll back git history. Use it in a clean, disposable branch or worktree, keep backups of uncommitted work, set explicit time and iteration limits yourself, and avoid using untrusted metric patterns or run commands.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:32
• Finding: Shell Command Injection Through an Unsanitized Metric Extraction Pattern## Vulnerability Details **File Location**: `SKILL.md`, lines 32-75 **Vulnerability Type**: Command injection through unsafe shell interpolation **Risk Level**: High ### Vulnerable Code The following is an English rendering of the relevant instructions: ```bash # The run command is supplied as a configuration parameter. <RUN_COMMAND> > run.log 2>&1 # The extraction pattern is inserted inside a shell command. grep "<EXTRACTION_PATTERN>" run.log ``` ### Technical Analysis The skill accepts a user-provided experiment command and metric extraction pattern, then interpolates those values into shell command strings. In particular, placing the extraction pattern between double quotes does not make it safe when the complete command is subsequently interpreted by a shell. An attacker can include a closing quote followed by shell control operators in the extraction pattern. This terminates the intended `grep` argument and appends an arbitrary command. The skill provides no validation, escaping, argument-array execution, or explicit approval of the fully resolved command. The experiment command is intentionally capable of executing shell operations, but the instructions do not establish command allowlists, repository boundaries, or other containment. The metric pattern creates an additional execution path where data presented as a search expression can become executable shell syntax. ### Attack Path 1. An attacker or untrusted task supplies a malicious metric extraction pattern resembling: ```text " run.log; arbitrary-command; # ``` 2. The agent substitutes the value into the documented command: ```bash grep "" run.log; arbitrary-command; #" run.log ``` 3. The shell interprets the semicolon as a command separator. 4. `arbitrary-command` executes with the same operating-system identity and permissions as the agent. 5. Because evaluation occurs in an autonomous loop, the i ...[truncated 696 chars]
• Remediation: ## Remediation Suggestions 1. Do not construct the `grep` operation through shell-string interpolation. Invoke the executable with a structured argument array, equivalent to: ```text ["grep", "--", extraction_pattern, "run.log"] ``` 2. If only simple prefixes or metric names are required, validate patterns against a restrictive allowlist rather than accepting arbitrary regular expressions. 3. If a shell is unavoidable, pass user-controlled values as positional parameters instead of embedding them in command text. 4. Reject unexpected control characters, command substitutions, newlines, and shell metacharacters. 5. Display the exact resolved experiment command and obtain explicit approval before its first execution. 6. Run experiments in a sandbox with restricted filesystem access, no unnecessary credentials, limited network access, and bounded process privileges. 7. Add tests using quotes, semicolons, command substitutions, newlines, and option-like patterns to verify that every pattern remains a literal argument.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:55
• Finding: Destructive Git Reset in an Unbounded Autonomous Execution Loop## Vulnerability Details **File Location**: `SKILL.md`, lines 55-126 **Vulnerability Type**: Unsafe destructive operation and unbounded resource consumption **Risk Level**: Medium ### Vulnerable Code The following is an English rendering of the relevant instructions: ```text Infinite loop until interrupted by the user. ``` ```bash git reset --hard HEAD~1 ``` ```text Never stop once the loop has started. Only modify the target file and do not touch other files. ``` ### Technical Analysis The skill directs the agent to run indefinitely and to discard unsuccessful experiments using `git reset --hard HEAD~1`. A hard reset changes the branch tip and forcibly replaces tracked working-tree and index content. The instructions do not require verification that the worktree was clean before the experiment, that the current branch is the temporary optimization branch, or that `HEAD~1` is the commit created by the current iteration. The instruction to modify only one target file does not protect unrelated tracked changes from `git reset --hard`. If a user has pre-existing tracked modifications, the reset can overwrite them. If branch state changes unexpectedly or a commit fails, `HEAD~1` may identify a commit unrelated to the current experiment. The unbounded loop compounds the risk by repeatedly executing user-selected commands, creating commits, and performing resets without a mandatory iteration, duration, cost, or resource limit. ### Attack Path 1. The skill starts in a repository containing pre-existing tracked changes, or its branch state changes during execution. 2. An experiment produces a worse metric, fails to emit a metric, or crashes. 3. The agent follows the discard procedure and executes: ```bash git reset --hard HEAD~1 ``` 4. Git moves the current branch backward and overwrites tracked index and working-tree content. 5. Pre-existing tracked changes or an unrelated commit may be removed ...[truncated 805 chars]
• Remediation: ## Remediation Suggestions 1. Require a clean worktree and index before starting, and abort if pre-existing changes are detected. 2. Record the baseline commit identifier and verify the active branch before every destructive operation. 3. Replace `git reset --hard HEAD~1` with a safer restoration method scoped to the authorized target file, or restore from a recorded commit after confirming the exact commit relationship. 4. Verify that `HEAD` is the experiment commit created by the current iteration before rolling it back. 5. Preserve user work through a dedicated worktree, temporary clone, or explicit backup reference. 6. Add configurable maximum iteration, wall-clock, compute-cost, and consecutive-failure limits. 7. Implement a stop file or cancellation signal checked before and after every experiment. 8. Apply process timeouts and terminate the entire subprocess group so child processes cannot survive a failed experiment. 9. Provide a final summary and stop safely when limits are reached instead of continuing indefinitely.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- 记录到 results.tsv

**Discard**（指标未改进或变差）:
- `git reset --hard HEAD~1` 回到上一个状态
- 记录到 results.tsv

**Crash**（运行失败）:

• Confidence: 98% confidence
• Finding: Using 'git reset --hard HEAD~1' is a destructive rollback operation that permanently discards uncommitted changes in the working tree and index, not just the last experiment's edit. In an autonomous loop, especially one triggered broadly and designed to run unattended, this can cause accidental data loss or removal of unrelated user work.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger description includes broad phrases like '自动优化', '持续改进某个指标', and '帮我跑优化实验', which can match ordinary user requests and invoke a highly autonomous skill unexpectedly. Because the skill can edit files, run Bash, and loop indefinitely, over-broad activation materially increases the chance of unintended execution of risky behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The description advertises an optimization skill but does not clearly warn that it will autonomously execute shell commands, create branches, modify code, write logs/results files, and continue iterating without further prompts. This mismatch can lead users to invoke the skill without understanding the operational and system impact, increasing the risk of unintended code changes, resource consumption, or destructive side effects.

Static analysis

No suspicious patterns detected.