Meta-Skill Orchestration Surface

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:36 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed orchestration guide, but it routes broad everyday requests into sensitive actions like cloud provisioning, calendar access, task-file updates, public posting, and package publishing without enough scoped approval guidance.

Review this skill before installing if you use connected cloud, browser, calendar, file, marketplace, or publishing tools. Require explicit confirmation for every external write, public post, deployment, package publish, credentialed action, or persistent file/memory update, and pin or sandbox any third-party installs it suggests.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/activation-map.md:274

Finding

Unpinned Third-Party Dependencies in the External Tool Inventory

Content

View full analysis

Vulnerability Details

File Location: references/activation-map.md:274-280
Vulnerability Type: Unpinned third-party package installation instructions
Risk Level: Medium

Vulnerable Code

markdown

| Repo | URL | Purpose | Install |
|------|-----|---------|---------|
| GitMCP | gitmcp.io | Any repo → instant MCP server | Replace github.com with gitmcp.io |
| LightRAG | github.com/HKUDS/LightRAG | Knowledge graph RAG | pip install lightrag-hku |
| AutoFigure | github.com/ResearAI/AutoFigure | Publication-ready SVG figures | pip install autofigure |
| MoLing-Minecraft | github.com/anthropics/moling | MCP Minecraft bridge | Go binary |
| AI-Researcher | github.com/HKUDS/AI-Researcher | Full paper generation | pip install ai-researcher |
| Claude Scientific Writer | internal | Citation-verified paper polish | Skill-based |
| Agent Squad | github.com/awslabs/agent-squad | Multi-agent routing | npm install agent-squad |

Technical Analysis

The documented pip and npm installation commands do not pin package versions, specify integrity hashes, or reference a reviewed lockfile. Consequently, the installed code is determined by the package registry at installation time rather than by the version reviewed during this audit.

Python packages can execute build-system logic during installation, while npm packages can execute lifecycle scripts. If a referenced publisher account, repository, release process, or registry entry is compromised, following these instructions may install and execute attacker-controlled code. Unpinned versions also expose users to unexpected or malicious behavior introduced by later releases.

Attack Path

1. An attacker compromises the publisher account or release process of one of the documented packages.
2. The attacker publishes a malicious release under the existing package name.
3. A user or automated agent follows an unpinned command such as `pip install lightrag- ...[truncated 770 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every package to an explicitly reviewed version, such as package==X.Y.Z for Python and package@X.Y.Z for npm.
2. Provide committed lockfiles and require deterministic installation modes, such as npm ci.
3. Record and verify package integrity hashes. For Python, use a requirements file with hashes and install using pip install --require-hashes.
4. Document the verified publisher identity, official source repository, and expected package name to reduce dependency-confusion and typosquatting risks.
5. Review package source, build configuration, transitive dependencies, and lifecycle scripts before approving upgrades.
6. Perform installation in a sandboxed, least-privileged environment without production credentials.
7. Introduce dependency scanning and an explicit update-review process rather than automatically accepting the latest release.

T08 · Insecure Dependencies

Warning

• Location: references/marketplace-bridges.md:55

Finding

Unpinned npm Installation Command for the Marketplace Package

Content

View full analysis

Vulnerability Details

File Location: references/marketplace-bridges.md:55
Vulnerability Type: Unpinned registry dependency installation
Risk Level: Medium

Vulnerable Code

markdown

1. Already published: npm install @toolate28/coherence-mcp

Technical Analysis

The command installs @toolate28/coherence-mcp without selecting a fixed version or verifying package integrity. npm will therefore resolve the dependency according to the registry state and default distribution tag at installation time. Although nearby documentation identifies published versions, the installation command does not constrain resolution to either reviewed version.

npm dependencies can define installation lifecycle scripts and bring in transitive dependencies. A compromised npm account, malicious new release, or compromised transitive package could therefore cause code not represented in this audited project to execute when a user follows the instruction.

Attack Path

1. An attacker gains control over the package publisher account, release pipeline, or a relevant transitive dependency.
2. The attacker publishes a malicious release selected by npm's default distribution tag.
3. A user or automated workflow executes npm install @toolate28/coherence-mcp.
4. npm downloads the current registry-selected release instead of a specifically reviewed version.
5. Any malicious lifecycle script or subsequently invoked package code executes with the installing account's permissions.

Impact Assessment

Successful exploitation could expose project files, environment variables, npm credentials, API tokens, and network-accessible services available to the invoking account. In build or release automation, it could also modify generated artifacts or contaminate downstream deployments. The maximum demonstrated privilege is that of the invoking user or CI account; the audited instruction does not independently provide privilege esca ...[truncated 7 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the command with a reviewed, exact version, for example npm install @toolate28/coherence-mcp@0.3.1.
2. Commit package-lock.json and use npm ci in automated environments.
3. Verify npm integrity metadata and package provenance before installation.
4. Audit direct and transitive dependencies with appropriate npm security and software-composition-analysis tooling.
5. Review lifecycle scripts and use --ignore-scripts where package functionality does not require them.
6. Run installation under a least-privileged account in an isolated environment without unrelated credentials.
7. Require security review and testing before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The activation description includes broad phrases such as 'what can you do', 'show me everything', and 'activate', which are common in ordinary conversation and can cause the skill to trigger outside its intended scope. Because this is a meta-orchestration skill with wide discovery and routing authority, accidental invocation could expose capabilities, alter tool selection, or hijack unrelated conversations into orchestration flows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The condition 'when another agent (Grok, Gemini) needs to understand what capabilities exist and how to invoke them' is ambiguous because it lacks a verifiable signal for when such need exists. This can lead to unintended activation based on weak references to other agents, causing unnecessary disclosure of internal capability maps or rerouting of tasks meant for normal handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases in this range are broad enough to match routine user requests, which can cause the orchestration skill to activate when the user did not intend it. Because this is a meta-skill that enumerates capabilities and routes into many downstream tools and skills, ambiguous activation increases the risk of unintended tool exposure, misrouting, and privilege expansion through normal conversation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section maps many generic words such as everyday work terms to specialized skills without clear boundaries, making accidental or adversarial invocation much easier. In the context of a full activation inventory that includes external services, browser automation, cloud tooling, publishing, and connector discovery, broad trigger matching can be abused to steer the agent into higher-risk capabilities than the user explicitly requested.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger set for the Competitive Intelligence Pipeline includes broad business phrases such as 'competitor analysis' and 'how do we compare', which can plausibly match ordinary exploratory requests and auto-route users into a multi-step chain. In an orchestration skill, overbroad activation is dangerous because it can invoke additional downstream tools, data access, or content-generation steps the user did not explicitly authorize.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The Institutional Formation Pipeline uses very broad phrases like 'set up the company' and 'board prep', which are common requests that may not imply consent to trigger legal, finance, and internal communications workflows. Because this meta-skill is designed to orchestrate other capabilities, ambiguous triggers increase the chance of unintended access to sensitive domains and generation of high-stakes legal or corporate outputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This section describes concrete infrastructure provisioning actions such as creating databases, KV namespaces, buckets, and deployments, but provides no warning that these are state-changing operations with cost and security implications. In a self-aware orchestration skill, omission of execution-safety guidance materially increases the risk of users or downstream agents treating the sequence as routine and performing destructive or billable actions without sufficient review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Edge Deployment Pipeline can be activated by vague phrases such as 'set up infrastructure' and 'deploy to edge', which overlap with many normal development conversations. In context, this is more dangerous than a generic ambiguity issue because the chain provisions databases, storage, and deployment targets, creating a path from casual language to system-impacting actions with cost, security, and availability consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Daily Operations Pipeline omits warnings that it reads calendar data and updates task files, both of which affect private user data and persistent state. Without disclosure and consent cues, the chain can normalize silent access to personal scheduling information and silent modification of workspace artifacts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Daily Operations Pipeline is keyed off broad phrases like 'start my day' and 'daily update', which are common conversational requests that could unintentionally trigger calendar access, enterprise search, and task modification. The orchestration context makes this riskier because a single casual phrase can fan out into multiple privacy-relevant actions across connected systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This pipeline includes publishing to external social platforms but does not warn that the action can create public, hard-to-retract outputs under the user's account. In skill-composition context, that omission is especially risky because downstream agents may infer that posting is a normal final step rather than a high-sensitivity action requiring explicit human approval.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The Content Monetization Pipeline includes triggers like 'publish to X' and 'social publishing', which may match generic publishing assistance requests but route into external posting actions. This is particularly dangerous because the chain includes a direct publishing step to external social platforms, so accidental activation can cause irreversible public actions and reputational damage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.