Security audit

Team Code

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate multi-agent coding workflow, but it tells agents to run broad install, git, and deletion commands without enough safety checks.

Install only if you are comfortable supervising high-impact repository automation. Use it in trusted or disposable workspaces, review dependency and build files before any pip/npm install, replace shell-string exec examples with argument-safe process APIs, and manually confirm any reset, deletion, push, or worktree cleanup step.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: references/examples.md:469
Finding: Shell Command Injection Through Unsanitized Project Paths and Task Identifiers
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:50
Finding: Automatic Execution of Unreviewed Dependency and Build Installation Logic
Content: View full analysis
/dev/null || pip install pytest ``` The complete reference implementation also performs the editable installation automatically: ```javascript async preSetup(projectPath) { // Prepare runtime await exec(`cd ${projectPath} && pip install -e .`); // Create stubs await this.createStubs(projectPath); // Commit to main await exec(`cd ${projectPath} && git add . && git commit -m "setup: initial"`); } ``` ### Technical Analysis The workflow treats dependency installation as a mandatory pre-setup action without first requiring inspection of dependency manifests, lockfiles, package sources, or local build configuration. The following execution channels are exposed: - `pip install -r requirements.txt` can retrieve and install attacker-selected packages. - `npm install` can run package lifecycle scripts. - `pip install -e .` processes the local project's packaging and build configuration and may invoke build backends or setup logic from an untrusted repository. - The fallback `pip install pytest` retrieves a package from the configured package index without requiring a version or hash. No hash verification, lockfile enforcement, trusted-index restriction, version pinning, installation approval, or disposable sandbox is specified. Redirecting standard error to `/dev/null` also suppresses information that could reveal a suspicious or failed installation. ### Attack Path 1. An attacker supplies ...[truncated 1294 chars]
Remediation: View remediation
/dev/null`; preserve and review installation diagnostics. 8. Generate and inspect a dependency resolution plan before executing installation. 9. Run vulnerability and provenance checks against resolved packages. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: references/examples.md:529
Finding: Destructive Workspace Cleanup and Git Synchronization Without Safety Validation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.
md
See [references/examples.md](references/examples.md) for detailed implementation examples.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: The skill instructs rm -rf ../workspace-agent-1 as part of cleanup. Recursive forced deletion on a relative path is dangerous because path confusion, variable substitution mistakes, or unexpected directory layout could cause deletion of unintended files outside the repo, and agentic execution increases the chance this command is run automatically.
Content: Scanner excerpt · references/examples.md (reported line 553)May include surrounding context.
md
git worktree remove ../workspace-agent-1 # 2. Clean up directory rm -rf ../workspace-agent-1 # 3. Verify worktree list git worktree list

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The example uses git reset --hard origin/main, which is a destructive repository-modifying command that can be abused or mistakenly applied to the wrong branch/worktree. In this skill's context—multi-agent code modification with branch/worktree orchestration—the command is more dangerous because users or subagents may execute it mechanically, causing irreversible loss of local changes or masking malicious tampering by force-aligning to remote state.
Content: Scanner excerpt · references/examples.md (reported line 569)May include surrounding context.
md
# Sync to latest main git fetch origin git reset --hard origin/main # OR: git rebase origin/main # Verify sync worked git log --oneline -3

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest description says to use the skill for broad situations like 'complex coding projects', 'multi-file features', and 'any project where parallel development beats solo coding' without defining concrete trigger phrases, boundaries, or exclusion conditions beyond general guidance. For a markdown/manifest file, this can make it unclear when the skill should activate versus when a normal coding skill should be used.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example includes git reset --hard origin/main as a synchronization pattern without a local safety warning or precondition checks. In a coordination skill that may be followed by autonomous agents or users, this can destroy uncommitted local work and silently discard changes, making it an unsafe operational pattern even if the author likely intended a routine reset workflow.
Content: No source excerpt is available for this finding.