Security audit

PIV - Plan Implement Validate

Security checks for vulnerabilities and agentic risk

Overview

This is a software-development workflow helper, but it can edit projects, run commands, spawn sub-agents, and create commits without clear approval safeguards.

Review this skill carefully before installing. It is not clearly malicious, but use it only on trusted repositories and require manual review of generated PRPs, planned file changes, validation commands, and any commit message before allowing execution or commits.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: references/execute-prp.md:17
Finding: Untrusted PRP Content Can Trigger Arbitrary Shell Commands
Content: View full analysis
Remediation: View remediation

other

Note

Location: SKILL.md:173
Finding: Mandatory Third-Party Promotional Footer in User Repository Commits
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (9)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs automatic git status/diff inspection and creation of a semantic commit after phase completion, with no mandatory confirmation step from the user. Commits are durable repository changes that may capture unintended files, secrets, or partially reviewed output from spawned sub-agents, making this especially risky in an automated multi-agent workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to create directories and copy template files into the target project automatically, but it does not require explicit user notice or confirmation before making filesystem changes. In a user-invocable orchestration skill that accepts paths and auto-discovers project locations, this can lead to unexpected modification of local files and creates risk if the derived project path is wrong or attacker-influenced.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs creating a PRD file but does not clearly warn that execution may create or overwrite a markdown file at the specified target path. This increases the risk of accidental data loss or unexpected repository modifications, especially when combined with the unconstrained path handling described above.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to write output to $ARGUMENTS with only a default fallback, but provides no restriction on allowed paths, no requirement to stay within a workspace, and no overwrite safeguards. In an agentic environment, this can enable arbitrary file write behavior to unintended locations, including clobbering existing project files or writing outside the expected repository if the argument is attacker-influenced.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This skill explicitly instructs the agent to create files and execute shell-based validation commands, but it does not require any user confirmation, safety notice, or scope restriction before making codebase changes or running commands. In an orchestration skill that may consume adversarial or incorrect PRP content, this increases the risk of unintended file modification, destructive command execution, or unsafe automation beyond what the user expected.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to implement changes using read, write, and edit tools, but it provides no user-facing warning, approval gate, or limitation on what files may be modified. In an orchestrator skill that operates on an arbitrary PROJECT_PATH and PRP, this can lead to unintended or overbroad modification of user code, especially if the PRP content is adversarial or mistaken.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to run validation and other commands via exec based on detected project files and PRP-specified commands, but it does not warn about subprocess execution or constrain what commands are allowed. Because both the PRP and repository contents may be attacker-controlled, this creates a command-execution pathway that could run harmful build scripts, test hooks, or arbitrary shell commands on the host system.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to run project-defined build, lint, and test commands, but provides no safety constraints, sandboxing requirements, or warning that such commands may execute arbitrary code from an untrusted repository. In practice, test and build scripts frequently invoke package hooks, shell commands, network access, or file-modifying steps, so an agent following this guidance could trigger unintended code execution or side effects during validation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to create and save a file inside the repository, which is a real write-to-disk side effect. While this is consistent with the skill's planning purpose and not inherently malicious, the instruction lacks any warning, confirmation step, or constraint on when filesystem modification is appropriate, which can lead to unintended repository changes in analysis-only contexts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.