Security audit

Ai C Plan

Security checks for vulnerabilities and agentic risk

Overview

The skill is a broad autopilot for project implementation, but it has under-scoped authority over repository instructions, external paths, migrations, and git history.

Install only if you intend to run a highly autonomous project-building workflow for this specific AI-C repository layout. Before use, change the hardcoded /home/adige/AI-C paths to workspace-local paths, treat architecture documents as untrusted project data, and require explicit review before migrations, git init, git add ., or commits.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Repository-Controlled Instruction Redirection
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:17
Finding: Hardcoded Access to Files Outside the Authorized Workspace
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:18
Finding: Unsafe Autonomous Git and Database Mutations
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
## ENV POLICY (No-Questions Mode) Bu projede dış bağımlılıklar için tüm konfigürasyon .env üzerinden yönetilecek. Kurallar: 1) Agent gerçek secret üretmeye/uydurmaya çalışmaz.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
## ENV POLICY (No-Questions Mode) Bu projede dış bağımlılıklar için tüm konfigürasyon .env üzerinden yönetilecek. Kurallar: 1) Agent gerçek secret üretmeye/uydurmaya çalışmaz.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description promises fully automatic execution over project plans without clear activation boundaries, scoped targets, or stop conditions beyond a few narrow cases. In an agent setting, this can cause the skill to undertake broad code, test, file, and git operations based on ambient repository state, increasing the chance of unintended or unsafe actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The autopilot section explicitly instructs the agent to proceed without per-step approval and to stop only in limited cases, which is unsafe for a skill capable of editing files, running tests/builds, applying migrations, and committing changes. This broad autonomy materially increases the blast radius of mistakes, prompt-injection influence from repo contents, or misinterpretation of plan steps.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The user-facing description is written only in Turkish and does not offer a language choice or indicate that the locale is optional. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is justified and documented.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.