Caid Multi Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:30 AM UTC
• Version: 1.2.0

Overview

This skill is for coordinated software work, but it asks agents to run broad Git, package-install, subagent, and cleanup operations with weak safeguards.

Use this only in dedicated, backed-up repositories and preferably in a sandbox. Before allowing it to run, require explicit approval for package installation, pushes to remotes, hard resets, and deletion; review staged diffs and remotes; validate worktree paths; and avoid exposing credentials or sensitive untracked files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: references/examples.md:469

Finding

Shell Command Injection Through Unvalidated Project Paths and Task IDs

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/examples.md:12

Finding

Automatic Execution of Untrusted Repository Build and Dependency Installation Logic

Content

View full analysis

/dev/null || pip install pytest ``` The complete corresponding manager method is: ```javascript async preSetup(projectPath) { // Prepare runtime await exec(`cd ${projectPath} && pip install -e .`); // Create stubs await this.createStubs(projectPath); // Commit to main await exec(`cd ${projectPath} && git add . && git commit -m "setup: initial"`); } ``` ### Technical Analysis The workflow automatically runs `pip install -e .` in the target repository during pre-setup, before establishing that the repository and its packaging configuration are trustworthy. Python package installation can invoke repository-selected build backends and other build-time behavior. Consequently, installing an untrusted local repository is a code-execution boundary, not merely a metadata or dependency-resolution operation. A malicious or compromised repository can use its packaging configuration or selected build components to execute code under the manager's identity. The fallback `pip install pytest` is also unpinned and depends on the configured package index and resolver state. Although `pytest` is a legitimate package name, the absence of a version lock and integrity hash reduces reproducibility and increases supply-chain exposure. ### Attack Path 1. The Agent is directed to coordinate work on an untrusted or compromised repository. 2. The repository contains malicious packaging configuration, a malicious build backend, or dependency declarations resolving to attacker-controlled artifacts. 3. The mandatory pre-setup phase executes `pip ins ...[truncated 1033 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:61

Finding

Unreviewed Git Publication and Destructive Workspace Operations

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

git reset --hard origin/main forcibly discards local changes, including uncommitted work, and can destroy engineer state if run in the wrong repository or at the wrong time. Because the skill presents this as a standard synchronization step for agents, it increases the chance of automated data loss and unsafe use without safeguards.

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

Engineer syncs to latest integrated state

cd ../workspace-engineer-1 git fetch origin git reset --hard origin/main # Sync worktree to latest main

text

**Worktree cleanup (after completion or limit reached):**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

rm -rf ../workspace-engineer-1 is a high-risk destructive command because a relative path can resolve unexpectedly depending on the current working directory, and recursive forced deletion is irreversible. In a multi-agent automation skill, an agent may execute this literally or with substituted parameters, turning documentation into a dangerous operational primitive that can wipe unrelated files.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

bash

# Remove worktree when engineer finishes or hits iteration limit
git worktree remove ../workspace-engineer-1
rm -rf ../workspace-engineer-1  # Clean up directory

Worktrees are deleted after all assigned tasks are completed or when the engineer reaches the predefined iteration limit.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

This second occurrence of git reset --hard origin/main repeats the same unsafe destructive sync pattern and normalizes hard resets as routine behavior. In the context of a skill meant to coordinate multiple agents and worktrees, repeated destructive examples make accidental or automated loss of code more likely.

Content

Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.

Engineer pulls latest main before continuing

cd ../workspace-engineer-1 git fetch origin git reset --hard origin/main # Or rebase

text

This ensures engineers work from latest integrated state.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.

md

See [references/examples.md](references/examples.md) for concrete implementation examples including:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

rm -rf ../workspace-engineer-1 is a high-risk deletion primitive embedded in instructions for autonomous workflow execution. If the path is malformed, symlinked, reused, or derived unsafely in future adaptations, the agent could recursively delete unintended directories with no recovery path.

Content

Scanner excerpt · references/examples.md (reported line 553)May include surrounding context.

md

git worktree remove ../workspace-engineer-1

# 2. Clean up directory
rm -rf ../workspace-engineer-1

# 3. Verify worktree list
git worktree list

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

git reset --hard origin/main is a destructive repository-state command that can erase local modifications and branch history from the working copy. In this skill, the command is presented as a normal state synchronization step for engineers, making accidental destructive use more likely in automated or semi-automated runs.

Content

Scanner excerpt · references/examples.md (reported line 569)May include surrounding context.

md

# Sync to latest main
git fetch origin
git reset --hard origin/main  # OR: git rebase origin/main

# Verify sync worked
git log --oneline -3

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documents destructive cleanup steps (git worktree remove followed by rm -rf) without requiring path validation, confirmation, or an explicit warning about data loss. In an agent-executed workflow, these commands could delete unintended directories or uncommitted work if workspace paths are wrong, symlinked, or reused, making the guidance operationally unsafe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example documents worktree cleanup using destructive filesystem operations without any warning, path validation, or safer alternatives. In an agent skill context, this is risky because an automated agent may execute the commands verbatim in the wrong directory or against an unexpected path, causing irreversible data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented synchronization flow includes git reset --hard origin/main without warning that it discards uncommitted and divergent local changes. In an automation setting, an agent could apply this blindly and destroy work product or overwrite investigation artifacts.

Content

No source excerpt is available for this finding.