Security audit

Agent Harness

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed agent-harness manager, but it needs review because it can launch persistent coding agents and includes a bundled payment script with a hard-coded API key.

Install only if you intentionally want a tool that delegates development work to ACP-configured coding agents. Before using it, confirm the target agent, exact task, workspace/files, timeout, whether a persistent session is needed, and review outputs before applying changes. Treat the SkillPay integration and bundled API key as unresolved security/account-boundary concerns, and do not send secrets or sensitive private code through external agents unless you trust the configured provider.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file adds a billing verification workflow and outbound payment-service communication that are unrelated to the stated ACP harness-management purpose. In agent skill contexts, unexpected monetization or remote authorization logic is dangerous because it can introduce undeclared external dependencies, surprise network egress, and hidden control over whether the skill functions.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The code gates skill usage on an external payment verification API despite the declared functionality being harness management. This creates an unjustified remote control point that can block or alter behavior outside the expected trust boundary, making the skill riskier in environments that assume local-only tooling behavior.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The docstring says payment must be verified before using the skill, but the exception path returns True and allows operation when verification fails. This fail-open behavior undermines the stated control, creates inconsistent security and billing semantics, and may allow bypass whenever the remote endpoint errors or is unreachable.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The invocation guidance is overly broad: '当用户需要调用 ACP agent 进行代码开发时，使用此 Skill。' provides no clear boundaries, approval checks, or task-scope constraints. In a skill that can create sessions, send coding tasks, and interact with multiple external coding agents, vague activation criteria can cause unintended delegation of sensitive work, excessive tool use, or bypass of safer default handling.

Vague Triggers

Medium

Confidence: 72% confidence
Finding: The trigger phrases are very broad and overlap with normal coding-assistant requests, so the skill may auto-activate in many routine development conversations. In context, this is more dangerous because activation can lead to spawning external coding agents and transmitting user code or task details to third-party systems without sufficiently specific intent or informed consent.

Missing User Warnings

High

Confidence: 99% confidence
Finding: A live API key is hardcoded directly in source and used in outbound requests, exposing a credential to anyone who can read the skill. This enables unauthorized use of the payment provider account, account abuse, billing fraud, and makes secret rotation difficult once the code is distributed.

Static analysis

No suspicious patterns detected.