Security audit

coware-skills

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent collaboration purpose, but its setup path delegates agent control to mutable remote instructions and limits normal user checkpoints.

Install only if you trust Coware and are comfortable with agents contacting coware.team, running .coware pull/sync scripts, and using project configuration during setup. Review the remote setup guide and any .coware scripts before allowing login, project joining, file changes, or spec synchronization.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:58
Finding: Untrusted Remote Instructions Can Hijack the Agent Workflow
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Ssd 4

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The setup flow tells the agent to read remote instructions and 'follow ALL instructions' end-to-end, 'in order', and to avoid normal textual clarification with the user. This creates an instruction-smuggling path where a mutable remote document can steer the agent into unsafe actions, while suppressing the usual user-checkpoint that might catch abuse or unexpected side effects.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger conditions include broad, ambiguous phrases such as 'team coordination' and 'vibe coding collaboration', which can cause the skill to activate in contexts unrelated to explicit user intent. Over-broad activation increases the chance that the agent will enter a workflow that performs network access or prescriptive setup steps unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to fetch a remote guide from https://coware.team/llms.txt without any requirement to notify the user or obtain consent for network access. This is dangerous because remote content is untrusted and can change over time, turning the skill into a conduit for hidden instructions or data exfiltration workflows.
Content: No source excerpt is available for this finding.