Security audit

Phoenix Iterate

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its stated strategy-iteration purpose, but it stores user-controlled run metadata as persistent LLM “constitutional memory” without validation or clear trust boundaries.

Install only in a dedicated strategy workspace and use it with trusted inputs. Review or sanitize memory/lessons.json before using briefings for LLM guidance, avoid recording untrusted free-form metadata, and consider pinning pandas plus adding path and input validation before relying on the skill for autonomous iteration.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

Location: orchestrator.py:171
Finding: Persistent Prompt Injection Through Constitutional Memory
Content: View full analysis
str: """Return a human-readable summary suitable for an LLM system prompt.""" lines: List[str] = [] lines.append("=== CONSTITUTIONAL MEMORY ===") if not self.lessons: lines.append("(No lessons recorded yet.)\n") else: severity_order = {"critical": 0, "high": 1, "medium": 2, "low": 3} sorted_lessons = sorted( self.lessons[-max_lessons:], key=lambda x: severity_order.get(x.get("severity", "medium"), 2), ) for lesson in sorted_lessons: sev = lesson.get("severity", "medium") tag = ( "CRITICAL" if sev == "critical" else "WARNING" if sev == "high" else "INFO" ) lines.append( f"[{tag}] [{lesson['strategy']}] {lesson['category']}: " ...[truncated 5225 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The skill description does not accurately match the behavior implied by the workflow: it claims end-to-end iteration and code generation/backtest submission, yet relies on sibling tools and also implies undeclared local inspection of directories and poller state. This mismatch is dangerous because operators may grant trust or invoke the skill under false assumptions, while the skill accesses local state and filesystem data not clearly disclosed in its declared purpose.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly instructs reading local files such as strategy code, results, and sibling-skill state while declaring no explicit tool scope or permissions boundary. In an orchestrator that touches local code and artifacts, missing scope declarations weaken least-privilege enforcement and can allow broader file access than users or the platform expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Broad trigger phrases like 'Let's iterate on the strategy' or 'What should I try next?' increase the chance of accidental invocation in normal conversation. In this skill's context, unintended activation could lead to local file inspection, strategy mutation guidance, or backtest-related actions without the user's explicit intent to run the orchestrated workflow.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency specification uses a lower-bound only constraint (pandas>=1.5.0), which permits installation of any future version and does not guarantee a reproducible or reviewed dependency set. This can expose the skill to vulnerable, breaking, or malicious upstream releases through normal dependency resolution, especially in an automated workflow that may be rerun over time.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
pandas>=1.5.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 ( DISPUTED pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 83% confidence
Finding: Because pandas is not pinned, it is impossible to verify from this manifest whether the environment will resolve to a release affected by known advisories or to a safe version. In this skill context, which supports code generation and quantitative strategy iteration, ambiguous dependency resolution increases supply-chain uncertainty and could affect systems processing untrusted data or serialized content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.