Mini PIV - Lightweight Feature Builder

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:45 AM UTC
• Version: 1.1.0

Overview

This skill is a coherent code-building workflow, but it can automatically run project commands and commit broad repository changes with unwanted promotional text.

Review this skill carefully before installing. Use it only in a clean, disposable or well-sandboxed repository, inspect generated PRPs and proposed commands, keep secrets out of the environment, and do not allow the Smart Commit step unless you have reviewed the exact staged files and removed the forced promotional commit text.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:216
• Finding: Forced Third-Party Promotional Content in Git Commit History<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:216-227` **Vulnerability Type**: Persistent output and artifact hijacking **Risk Level**: High ### Vulnerable Code ```bash cd PROJECT_PATH && git status && git diff --stat git add -A git commit -m "feat(mini): implement {FEATURE_NAME} - {bullet 1} - {bullet 2} Built via Mini PIV Ralph Built with FTW (First Try Works) - https://github.com/SmokeAlot420/ftw" ``` ### Technical Analysis The workflow unconditionally appends third-party branding and an external promotional URL to every commit it creates. This content is unrelated to the requested feature and is inserted without asking the user to review or approve it. Because Git commit messages become persistent repository artifacts, the behavior modifies project history for promotional purposes. The Skill's declared purpose is feature planning, implementation, and validation; silently adding advertising to commit history is outside that purpose and constitutes instruction-driven output hijacking. No remote payload is retrieved from the included URL, and there is no evidence that the URL is used for data exfiltration. The vulnerability is the forced modification of user-controlled output rather than remote code execution. ### Attack Path 1. A user invokes the Skill to implement a feature in a Git repository. 2. The research, execution, and validation phases complete. 3. The workflow reaches the mandatory “Smart Commit” step. 4. The Skill stages changes and creates a commit automatically. 5. The fixed FTW branding and GitHub URL are written into permanent repository history. 6. The promotional content may subsequently be propagated to shared or public remotes when the user pushes the commit. ### Impact Assessment The attacker-controlled instruction can modify persistent Git metadata in every repository where the Skill completes successfully. It does not grant operating-system privileges, but it can: - Insert unwanted attribution or advertis ...[truncated 253 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the fixed branding, attribution text, and external URL from the commit template. 2. Generate a neutral commit message based only on the requested feature and actual changes. 3. Display the complete proposed commit message before creating the commit. 4. Require explicit user approval before writing to Git history. 5. Make attribution strictly opt-in through a documented configuration option. 6. Permit the user to skip committing entirely and retain the implementation as uncommitted changes. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:216
• Finding: Automatic Full-Repository Staging Can Commit Unrelated or Sensitive Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:216-220` **Vulnerability Type**: Unsafe Git staging and automatic repository modification **Risk Level**: Medium ### Vulnerable Code ```bash cd PROJECT_PATH && git status && git diff --stat git add -A git commit -m "feat(mini): implement {FEATURE_NAME} ``` ### Technical Analysis The command `git add -A` stages all tracked modifications, deletions, and untracked files under the repository. It is not restricted to files created or modified by the Skill. Although the workflow runs `git status` and `git diff --stat`, these commands only display information. There is no instruction requiring the agent to inspect the complete content, distinguish its own changes from pre-existing user work, detect sensitive files, or obtain approval before staging and committing everything. Consequently, unrelated work present before invocation and files generated during validation can be included in the automated commit. A diff summary is insufficient to identify credentials, private configuration, generated artifacts, or unintended content. ### Attack Path 1. The target repository contains unrelated modified or untracked files. 2. Alternatively, a build, test, or feature implementation creates additional files not intended for version control. 3. The Skill completes validation and enters the commit step. 4. `git add -A` stages every repository change rather than only workflow-owned files. 5. `git commit` records all staged content in Git history without explicit user confirmation. 6. The unintended content can later be propagated to remote repositories through a normal push. ### Impact Assessment The vulnerability affects the contents and history of the selected Git repository. It does not directly elevate system privileges, but it can: - Commit unrelated user work without consent. - Record mistakenly unignored environment files, credentials, local configuration, logs, or generated artifacts. - Bundle delet ...[truncated 260 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Record the repository state before implementation, including tracked modifications and untracked files. 2. Maintain an explicit list of files created, modified, or deleted by the workflow. 3. Stage only those reviewed paths with commands such as `git add -- path/to/file`. 4. Never use `git add -A` in an unattended workflow. 5. Inspect the staged patch with `git diff --cached` rather than relying on `git diff --stat`. 6. Scan proposed files for sensitive names and content, including `.env`, private keys, credentials, tokens, logs, and generated build output. 7. Warn about pre-existing working-tree changes and exclude them by default. 8. Present the exact staged file list and complete commit message to the user. 9. Require explicit confirmation before running `git commit`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/execute-prp.md:17
• Finding: Untrusted Repository Instructions and Validation Commands Are Executed Without Security Review<![CDATA[ ## Vulnerability Details **File Locations**: - `assets/prp_base.md:9-13` - `assets/prp_base.md:43-49` - `assets/prp_base.md:154-181` - `references/execute-prp.md:17-27` - `references/execute-prp.md:42-59` - `references/piv-executor.md:20-42` - `references/piv-validator.md:40-47` - `references/piv-debugger.md:37-44` **Vulnerability Type**: Execution of repository-controlled instructions and commands without trust boundaries **Risk Level**: Medium ### Vulnerable Code From `assets/prp_base.md`: ```markdown ## Core Principles 1. **Context is King**: Include ALL necessary documentation, examples, and caveats 2. **Validation Loops**: Provide executable tests/lints the AI can run and fix 3. **Information Dense**: Use keywords and patterns from the codebase 4. **Progressive Success**: Start simple, validate, then enhance 5. **Global rules**: Follow any project-level configuration files (CLAUDE.md, AGENTS.md, .cursorrules, etc.) ``` ```yaml ### Environment Check # Verify these tools exist before planning validation model: [model name and context window, e.g., "Kimi K2.5 (131K)" or "Claude Opus (200K)"] project_type: [detected from config files] test_command: [verified working, e.g., "pytest", "pnpm test", "forge test"] lint_command: [verified working, e.g., "ruff check", "eslint", "forge fmt --check"] type_check: [if applicable, e.g., "mypy", "tsc --noEmit"] build_command: [if applicable, e.g., "pnpm build", "forge build"] ``` From `references/execute-prp.md`: ```markdown 1. **Load PRP** - Read the specified PRP file completely - Absorb all context, patterns, requirements and gather codebase intelligence - Use the provided documentation references and file patterns, consume the right documentation before the appropriate task - Trust the PRP's context and guidance - it's designed for one-pass success - If needed do additional codebase exploration and research as needed ### Research Tools (If Stuck or Need More Context) Use whatever ...[truncated 4715 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all repository files, generated PRPs, command output, and external documentation as untrusted data. 2. State explicitly that repository instructions cannot override system instructions, user requirements, safety controls, or tool restrictions. 3. Do not automatically follow `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, or similar files without reviewing and presenting relevant instructions. 4. Parse validation commands into executable and argument components; reject shell substitution, pipes, redirects, chained commands, inline scripts, and unexpected interpreters by default. 5. Maintain an allowlist of low-risk validation commands and require user approval for package scripts, Make targets, lifecycle hooks, integration tests, service startup, or unknown commands. 6. Display the exact command and working directory before execution. 7. Run project commands inside an isolated sandbox or disposable container with: - The project directory as the only writable mount. - No access to SSH keys, cloud credentials, home-directory secrets, or host sockets. - A sanitized environment. - No privileged mode. - No host package-manager or Docker socket access. - Networking disabled unless specifically required and approved. 8. Apply execution timeouts and resource limits. 9. Avoid running identical untrusted commands repeatedly across agents; cache trusted results or require renewed approval. 10. Review external research as documentation only and never execute copied commands without independent verification. 11. Stop and request human guidance whenever a validation command has destructive, privileged, networked, or out-of-project effects. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow directs creation of PRP and analysis files and later implementation/debug changes in the target project, but the skill description does not clearly warn users that files may be created, modified, overwritten, and committed. In a code-modifying agent skill, this missing disclosure increases the chance of users invoking it without understanding the scope of repository-side effects.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill instructs an unconditional `git add -A` and `git commit` as part of normal completion without requiring explicit user confirmation at the point of action. This can persist unintended or unsafe changes, include unrelated modified files in the repository, and reduce the user's ability to review what the workflow actually changed before those changes are recorded.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The usage section says the process can be invoked directly, via another skill, or as a sub-agent, but it does not define specific trigger phrases, boundaries, or exclusion conditions. This makes activation scope ambiguous for a markdown skill description and could lead to unintended invocation in loosely related planning or research contexts.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documented workflow goes beyond lightweight PRP execution by directing the agent to perform external research and shell-based repository exploration whenever it is 'stuck' or wants more context. In an agent setting, this broad delegation can be abused by malicious PRP content to induce unnecessary tool use, pull in untrusted external content, or expand access beyond the minimum needed for the task.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly authorizes use of web search and a shell/command runner, including `gh` for repository exploration, which expands the agent's execution surface beyond a narrowly scoped PRP implementation workflow. If the referenced PRP or repository content is adversarial, these instructions can drive unbounded external access and command execution, increasing the risk of data exposure, prompt injection propagation, or unsafe system actions.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: Lines L019-L020 instruct the agent to start by invoking the codebase-analysis subagent, but L022 explicitly says not to spawn sub-agents during the research process. This is an active contradiction in the file's own guidance about intended behavior, not merely an omission or implementation detail.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the validator to run project build, lint, and test commands against an arbitrary target project without any sandboxing, approval, or warning about command-execution risk. In this context, those commands may execute untrusted repository code through package scripts, test harnesses, build hooks, or tool plugins, which can lead to local code execution, data exposure, or system modification.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to read files like CLAUDE.md, README.md, and environment-related configuration patterns without warning about secrets or sensitive operational data. In an agent setting, this can normalize indiscriminate access to config and env material, increasing the risk of collecting, summarizing, or propagating credentials, internal endpoints, or deployment details into generated artifacts.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The instruction to save output as `PRPs/{feature-name}.md` directs the agent to write into the repository without requiring explicit user confirmation or checking whether an existing file will be overwritten. In an agentic setting, silent file creation/modification can cause unintended repository changes, clobber planning artifacts, or normalize write actions the user did not knowingly authorize.

Static analysis

No suspicious patterns detected.