Security audit

Mini PIV - Lightweight Feature Builder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent code-building workflow, but it can automatically run project commands and commit broad repository changes with unwanted promotional text.

Review this skill carefully before installing. Use it only in a clean, disposable or well-sandboxed repository, inspect generated PRPs and proposed commands, keep secrets out of the environment, and do not allow the Smart Commit step unless you have reviewed the exact staged files and removed the forced promotional commit text.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:216
Finding: Forced Third-Party Promotional Content in Git Commit History
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:216
Finding: Automatic Full-Repository Staging Can Commit Unrelated or Sensitive Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/execute-prp.md:17
Finding: Untrusted Repository Instructions and Validation Commands Are Executed Without Security Review
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The workflow directs creation of PRP and analysis files and later implementation/debug changes in the target project, but the skill description does not clearly warn users that files may be created, modified, overwritten, and committed. In a code-modifying agent skill, this missing disclosure increases the chance of users invoking it without understanding the scope of repository-side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs an unconditional git add -A and git commit as part of normal completion without requiring explicit user confirmation at the point of action. This can persist unintended or unsafe changes, include unrelated modified files in the repository, and reduce the user's ability to review what the workflow actually changed before those changes are recorded.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The usage section says the process can be invoked directly, via another skill, or as a sub-agent, but it does not define specific trigger phrases, boundaries, or exclusion conditions. This makes activation scope ambiguous for a markdown skill description and could lead to unintended invocation in loosely related planning or research contexts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documented workflow goes beyond lightweight PRP execution by directing the agent to perform external research and shell-based repository exploration whenever it is 'stuck' or wants more context. In an agent setting, this broad delegation can be abused by malicious PRP content to induce unnecessary tool use, pull in untrusted external content, or expand access beyond the minimum needed for the task.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly authorizes use of web search and a shell/command runner, including gh for repository exploration, which expands the agent's execution surface beyond a narrowly scoped PRP implementation workflow. If the referenced PRP or repository content is adversarial, these instructions can drive unbounded external access and command execution, increasing the risk of data exposure, prompt injection propagation, or unsafe system actions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Lines L019-L020 instruct the agent to start by invoking the codebase-analysis subagent, but L022 explicitly says not to spawn sub-agents during the research process. This is an active contradiction in the file's own guidance about intended behavior, not merely an omission or implementation detail.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs the validator to run project build, lint, and test commands against an arbitrary target project without any sandboxing, approval, or warning about command-execution risk. In this context, those commands may execute untrusted repository code through package scripts, test harnesses, build hooks, or tool plugins, which can lead to local code execution, data exposure, or system modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to read files like CLAUDE.md, README.md, and environment-related configuration patterns without warning about secrets or sensitive operational data. In an agent setting, this can normalize indiscriminate access to config and env material, increasing the risk of collecting, summarizing, or propagating credentials, internal endpoints, or deployment details into generated artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instruction to save output as PRPs/{feature-name}.md directs the agent to write into the repository without requiring explicit user confirmation or checking whether an existing file will be overwritten. In an agentic setting, silent file creation/modification can cause unintended repository changes, clobber planning artifacts, or normalize write actions the user did not knowingly authorize.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.