Security audit

solar-delegation

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Solar delegation skill, but it needs review because it can send broadly defined session context to an external model provider and gives weak guidance for protecting the OpenRouter API key.

Install only if you are comfortable with long responses being delegated to OpenRouter/Upstage. Keep delegation disabled or use a high threshold for confidential work and shared messenger channels, send only the minimum needed context, review output before forwarding it, and store the OpenRouter key in a protected secret mechanism rather than committing or sharing config files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:31
Finding: Unbounded Disclosure of Session Context to an External Model Provider
Content: View full analysis
= threshold, run `sessions_spawn` with Solar Pro3. Example spawn task pattern: ```text 중요: 도구(tool)를 사용하지 말고 텍스트만 바로 출력해줘. 파일 읽기/쓰기 등 도구 호출 금지. ``` Set model to: - `openrouter/upstage/solar-pro-3` ### Main Session Use `sessions_spawn` and wait for auto-announced result. ### Messenger Sessions (Slack/Telegram/etc.) Use `sessions_spawn`, then fetch the final assistant text and forward it through the appropriate message channel/thread. If no final text arrives within a reasonable timeout, fall back to direct response. ## Rules - Pass through Solar output as-is (no extra summary/footer/metadata). - Keep non-user-facing orchestration text minimal. - Do not output intermediate narration between tool calls. - Always include the “no tool call” instruction in spawn tasks. ``` ### Technical Analysis The Skill intentionally delegates text generation to the external model `openrouter/upstage/solar-pro-3`. External network communication is necessary for the declared delegation feature, but the instruction to send `` does not define or enforce a minimum-data boundary. There are no documented controls requiring the agent to: - Include only the text strictly necessary for the drafting task. - Exclude API keys, credentials, hidden prompts, tool results, persistent memory, or unrelated conversation history. - Detect or redact personal, confidential, or proprietary information. - Notify the user that content will be transmitted to OpenRouter and potentially a downstream model provider. - Obtain per-request consent for sensitive transfers. - Review or vali ...[truncated 2078 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The example spawn task includes a Korean-only instruction that can bias or override the delegated model's response language without any user request, locale check, or documented justification. In this skill, delegated output is intended to be passed through as-is, so a hard-coded foreign-language instruction can directly alter user-facing content, causing confusion, misdelivery, or policy/compliance issues in multilingual environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guide instructs users to place a live OpenRouter API key directly into a JSON config example (apiKey: sk-or-YOUR-KEY-HERE) without warning about secret handling, environment-variable substitution, file permissions, or avoiding commits to source control. This can lead to accidental credential exposure through checked-in config files, shared screenshots, backups, or local compromise, especially because this skill explicitly introduces a second provider credential into the agent environment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.