Branerail - CTO-level architectural skill for Claude Code

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:24 AM UTC
• Version: 1.0.0

Overview

This is a broad architectural-guidance skill; it has some scope and supply-chain cautions, but I found no hidden data access, exfiltration, destructive behavior, or unauthorized persistence.

Install this only if you want architectural guidance to apply broadly across coding work. Before running any commands from the docs, review what will be copied or published, pin or sandbox npx/pip tooling, and avoid npm/GitHub publishing steps unless you are intentionally releasing the package publicly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:392

Finding

Unpinned npm Package Download and Execution via npx

Content

View full analysis

tailwind.theme.json # Export to W3C DTCG npx @google/design.md export --format dtcg DESIGN.md > tokens.json ``` The integration guide repeats the same unsafe dependency-resolution pattern: ```bash npx @google/design.md lint DESIGN.md npx @google/design.md export --format tailwind DESIGN.md > tailwind.theme.json npx @google/design.md export --format dtcg DESIGN.md > tokens.json ``` ### Technical Analysis The documented commands invoke an npm package without specifying an exact audited version. Depending on local npm configuration and whether the package is already installed, `npx` can retrieve the current package release from the npm registry and execute it immediately. This makes the effective executable payload mutable after the Skill has been reviewed. The behavior is not inherently malicious, but it creates a supply-chain trust boundary that is not disclosed or constrained through an exact version, lockfile, integrity metadata, offline execution, or sandbox. A compromised package release, registry account, dependency, or package installation hook could execute arbitrary code under the identity of the user following the documentation. The validation and token-export functionality does not require unrestricted execution of a mutable remote dependency, so the instructions exceed minimum safe privilege. ### Attack Path 1. An attacker compromises ...[truncated 1272 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: GITHUB_PUBLISHING_GUIDE.md:559

Finding

Unpinned Python Documentation Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence

Findings (38)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PUBLISHING_COMPLETE.txt (reported line 271)May include surrounding context.

text

If git push fails:
  → Check GitHub authentication (SSH or HTTPS)
  → Set up SSH keys or PAT (personal access token)
  → Verify remote: git remote -v

If package.json has errors:

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly says to 'trigger aggressively' and its description covers a very wide set of common engineering terms. In an agentic environment, that can cause the skill to be invoked in many contexts where it is not needed, creating prompt-scope expansion, instruction interference, and reduced reliability of downstream tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger keyword list includes many generic terms like 'design,' 'optimize,' 'dependency,' 'API,' and 'code review' without contextual constraints. This makes accidental activation likely, which can redirect the agent into this skill unnecessarily and increase the chance of conflicting guidance or task derailment.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · INTEGRATION_GUIDE.md (reported line 407)May include surrounding context.

md

→ Read README.md, then copy spec_template.md

**"Is this overkill for small projects?"**  
→ No. Even small systems benefit from clear state ownership and observability.

**"Will this slow me down?"**  
→ Upfront (spec writing). Saves debugging (days). Net positive.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · START_HERE.md (reported line 210)May include surrounding context.

md

→ Read README.md, then copy spec_template.md

**"Is this overkill for small projects?"**  
→ No. Even small systems benefit from clear state ownership and observability.

**"Will this slow me down?"**  
→ Upfront (spec writing). Saves debugging (days). Net positive.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · package-skill.sh (reported line 432)May include surrounding context.

sh

*.swp
*.swo
*~
.env
.env.local
EOF

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · package-skill.sh (reported line 433)May include surrounding context.

sh

*.swo
*~
.env
.env.local
EOF

# Summary

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list is broad enough to match common engineering terms like 'design', 'performance', 'failure', 'refactor', and 'logging', which can cause the skill to activate in many routine conversations outside its intended scope. In an agent setting, ambiguous activation can steer workflows, inject large amounts of guidance, or overshadow more appropriate skills, creating reliability and policy-enforcement risks even if the content itself is not overtly malicious.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad generic terms such as "architecture," "design," "scale," and "performance," which can cause the skill to activate in many unrelated contexts. Over-broad activation increases the chance that the skill influences tasks it was not intended for, creating prompt-scope confusion and potentially unsafe or low-quality behavior in downstream agent workflows.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INTEGRATION_GUIDE.md (reported line 32)May include surrounding context.

1. Download the files: All files are in /mnt/user-data/outputs/

2. Create skill directory:

   bash

   mkdir -p ~/.claude/skills/systemdesign
   cp SKILL.md ~/.claude/skills/systemdesign/
   

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · INTEGRATION_GUIDE.md (reported line 34)May include surrounding context.

2. Create skill directory:

   bash

   mkdir -p ~/.claude/skills/systemdesign
   cp SKILL.md ~/.claude/skills/systemdesign/
   mkdir ~/.claude/skills/systemdesign/references
   cp spec_template.md DESIGN_template.md code_review_checklist.md \
   

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · INTEGRATION_GUIDE.md (reported line 36)May include surrounding context.

bash

   mkdir -p ~/.claude/skills/systemdesign
   cp SKILL.md ~/.claude/skills/systemdesign/
   mkdir ~/.claude/skills/systemdesign/references
   cp spec_template.md DESIGN_template.md code_review_checklist.md \
     ~/.claude/skills/systemdesign/references/

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The guide instructs users to run npx @google/design.md without pinning an exact package version. npx will fetch the latest package at execution time, which creates a supply-chain risk: a compromised upstream release or unexpected breaking change could execute arbitrary code or alter validation/export behavior on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This command again invokes an unpinned package via npx, causing the executed code to depend on whatever version is current at runtime. That exposes users to package takeover, malicious updates, or non-reproducible behavior during design token export.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This is a third occurrence of the same supply-chain pattern: executing a remote package with npx and no version pin. Even in documentation, this normalizes unsafe install-and-run behavior and can lead to arbitrary code execution if the package or dependency chain is compromised.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger keywords span many common engineering terms such as "design," "performance," "logging," and "state," making activation likely during ordinary conversations. Over-broad auto-triggering can inject this skill's guidance into unrelated tasks, increasing prompt-collision risk, context pollution, and accidental influence over workflows that did not request this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The phrase that the skill should trigger "whenever you mention" listed terms is ambiguous and effectively unconditional for many routine development discussions. In agent systems, this can cause the skill to activate too broadly, override user intent, and create hard-to-predict prompt behavior across sessions or projects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file defines activation keywords such as "architecture," "design," "scale," and even "Any code generation prompt" and "Any discussion of system design," which are broad enough to overlap with many normal developer interactions. The file does not provide exclusion conditions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The document instructs users to run npx @google/design.md lint DESIGN.md without pinning an exact package version. This creates a supply-chain risk because npx will fetch and execute whatever package version is current at runtime, allowing malicious updates, dependency compromise, or unexpected behavior to run on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document instructs the user to run a local packaging script and then publish artifacts to external services, but it does not warn that the script may create or modify repository files or that publication is public and potentially irreversible. This omission increases the chance of accidental disclosure, unreviewed file generation, or unintended distribution of sensitive or harmful content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file gives immediate publishing guidance such as 'Run: bash package-skill.sh' and directs the user to publish to GitHub and NPM without clearly constraining what should be reviewed first. In an agent-skill context, broad publish/run instructions are risky because users may execute or release bundled content before auditing it, potentially exposing sensitive files or propagating unsafe material publicly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide instructs users to copy all files from a local output directory into a public GitHub repository without any warning to review contents for secrets, internal artifacts, or unintended files. This can lead to accidental public disclosure of sensitive or proprietary material, especially because the source path suggests generated local workspace output that may contain more than the intended publishable files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The NPM publishing section tells users to run npm publish but does not warn that this action publicly distributes the package contents to the registry. Users may unintentionally publish sensitive files, credentials, internal docs, or incomplete artifacts if package contents are not reviewed first.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger keywords are extremely broad and cover many ordinary software-development terms such as architecture, API, performance, logging, refactor, and code review. In agent skill systems, such breadth can cause the skill to activate in many unrelated conversations, unexpectedly injecting its instructions, expanding its influence surface, and potentially steering workflows or prompting command use where it was not explicitly requested.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to execute npx @google/design.md without pinning an exact package version. Because npx fetches the latest published package by default, a compromised upstream release, dependency hijack, or breaking update could result in unreviewed code execution on the user's machine during routine use of the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.