Security audit

Sigmaflow Deploy

Security checks for vulnerabilities and agentic risk

Overview

This deployment skill is disclosed as a Git/SvelteKit deploy helper, but it embeds a repository token, uses plaintext HTTP, and can automatically commit and push all local changes.

Do not install this skill as-is unless you control the GitLab instance and have already revoked or rotated the embedded token. Replace the token with a secure runtime secret, use HTTPS or SSH, require explicit confirmation before committing or pushing, and avoid git add . in favor of a reviewed allowlist or clean deployment checkout.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/deploy.sh:7
Finding: Hardcoded repository credential transmitted over plaintext HTTP
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/deploy.sh:29
Finding: Unverified mutable remote code and package lifecycle scripts are executed locally
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/deploy.sh:48
Finding: Unrestricted staging and push can disclose unintended sensitive files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill documentation explicitly discloses an embedded Git access token and describes authenticated Git operations using that secret. It also frames deployment as a simple build/push workflow while including automatic staging and committing of all repository changes, which expands the behavior beyond a narrowly scoped deploy action and can leak unintended files or modifications.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script hardcodes a Git authentication token and embeds it directly into clone and push URLs over plain HTTP. This exposes the credential to anyone with access to the script, shell history, process arguments, logs, or network path, enabling repository compromise and unauthorized code access or tampering.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is described for use after virtually any code change, feature work, bug fix, or production-prep step, which makes it easy for an agent to invoke a high-impact deployment/push workflow too broadly. In the context of a skill that can modify Git state and push to a remote repository, vague activation criteria increase the chance of accidental or premature deployment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The "When to Run" guidance lacks guardrails and negative examples, encouraging use for broad development milestones rather than narrowly defined deployment events. Because this skill performs repository updates and remote pushes, unclear triggers materially raise the risk of unintended execution and unauthorized code publication.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This shell script runs npm install and npm run build, which execute project-defined package lifecycle and build scripts that can modify the working tree and run arbitrary commands on the host. Although there are informational logs, there is no warning or confirmation that the script will execute these subprocesses as part of deployment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script uses git add ., git commit, and git push to publish all detected changes, which can alter version history and remote repository contents. While the script logs each step, it does not provide a clear warning or confirmation before performing these potentially irreversible repository operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The documentation states that success output includes [INFO] messages and a final deployment confirmation, which prescribes a specific output style rather than offering user choice. If this skill is expected to interact with users in varying locales, fixing one language/labeling convention without opt-in can conflict with language or locale policy expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.