Security audit

Piv

Security checks for vulnerabilities and agentic risk

Overview

This is a software-development workflow skill, but it can edit repositories, run project commands, spawn sub-agents, and create branded git commits without enough user control.

Install only if you are comfortable with an agent modifying the target repository, running project-defined commands, spawning sub-agents, and creating commits. Review proposed file changes and validation commands first, avoid running it on untrusted repositories, and do not allow automatic commits unless you approve the exact message and changed files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:210
Finding: Forced Third-Party Promotional Content in Automatic Git Commits
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: assets/prp_base.md:12
Finding: Indirect Prompt Injection Through Project-Controlled Instruction Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/piv-executor.md:25
Finding: Unrestricted Execution of Commands Supplied Through Generated PRPs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:107
Finding: Shell Command Injection Through Unquoted User-Derived Project Paths
Content: View full analysis
/dev/null | grep -i "phase.*N\|pN\|p-N" ``` ``` ```markdown ### Step 5: Smart Commit ```bash cd PROJECT_PATH && git status && git diff --stat ``` ``` ### Technical Analysis `PROJECT_PATH` is derived from invocation arguments and is embedded into shell examples without quoting, canonicalization, or argument separation. If an agent performs direct textual substitution, whitespace and shell metacharacters in a crafted path may be interpreted as syntax rather than as part of a filesystem path. Even benign paths containing spaces can cause operations to target incorrect locations. A malicious path containing separators such as `;`, command substitution, redirection, or other shell syntax could append attacker-controlled commands. Paths beginning with option-like characters may also be misinterpreted by utilities when `--` is not used. The exploitability depends on how the hosting agent translates these templates into tool calls. The unsafe construction nevertheless cre ...[truncated 980 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to create directories and write project files (for example PRDs, PRPs, templates, and WORKFLOW.md) automatically, but it does not require explicit user confirmation or provide a user-facing warning before making filesystem changes. In an agent setting, this creates a real risk of unintended modification of the user's workspace, especially because discovery mode can proceed from vague input into concrete writes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The workflow includes automated git status, diff inspection, and semantic commit creation without a clear user warning or approval gate before modifying repository history. Automated commits can permanently alter a repository's audit trail and may capture unintended changes, which is particularly risky in a multi-phase orchestrator that spawns sub-agents and performs iterative edits.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file describes invocation modes such as 'As a standalone codebase analysis task' and 'As a sub-agent' without defining specific trigger phrases, scope boundaries, or exclusion conditions. Because the activation conditions are described only at a high level, the skill could be invoked in ambiguous contexts rather than a clearly constrained workflow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Lines L019-L020 explicitly instruct the user to invoke a codebase-analysis subagent, but L022 immediately says 'Do NOT spawn sub-agents.' This is an active contradiction in the file's operational guidance, not merely an omission or implementation detail.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to create directories and write a PRD file to the project path, but it does not require any user-facing notice, confirmation, or safety check before modifying the filesystem. In an orchestration skill that may operate on arbitrary user-provided project paths, silent writes can cause unintended file creation, overwrite risks, and surprising side effects, making this a real safety issue even if the intent is workflow automation rather than abuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to modify project files and execute validation commands, but it does not include any user-facing safety constraints, confirmation requirements, or guardrails limiting command scope. In an agent setting, this can lead to unintended system-impacting actions such as destructive edits, risky shell execution, or running untrusted project-defined commands from a PRP or repository context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to run whatever build, lint, test, or type-check commands the target project uses, which can execute untrusted code from the repository. In many ecosystems, test and build commands invoke arbitrary scripts, dependency hooks, plugins, or Makefile targets, so this creates a code-execution path on the analyst's environment without any safety warning, sandboxing requirement, or approval gate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs the agent to create PRPs/planning/{feature-name}-analysis.md, which modifies the workspace, but it does not clearly warn that this is a write action or require confirmation/checks before writing. In agentic environments, implicit file writes can cause unintended repository changes, overwrite existing planning artifacts, or be abused through crafted feature names if path handling is weak elsewhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs the agent to write output directly to a user-provided path ($ARGUMENTS) without any explicit warning, path restrictions, or overwrite safeguards. In an orchestration skill, this can lead to unintended file creation or overwriting of repository files, configuration files, or documentation if the path is influenced by the user or upstream automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: Line L033 directs the agent to add a .md file under PRPs/ai_docs, which is a file-writing operation. The document does not include any warning that this process will create or modify files in the repository, so users are not explicitly informed of that side effect.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.