Subagent-Driven Development

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:20 AM UTC
• Version: 1.0.1

Overview

This is a disclosed development workflow skill that delegates coding tasks to subagents and reviewers; it has usability caveats but no artifact-backed malicious behavior.

Install this only if you want an agentic coding workflow that delegates implementation and review to subagents and may commit changes in your repository. Review generated commits before merging, and be aware that some escalation/help text may appear in Chinese unless adapted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

"Mark task complete in TodoWrite" [shape=box];
    }

    "Read plan, extract all tasks with full text, note context, create TodoWrite" [shape=box];
    "More tasks remain?" [shape=diamond];
    "Dispatch final code reviewer subagent for entire implementation" [shape=box];
    "Use superpowers:finishing-a-development-branch" [shape=box style=filled fillcolor=lightgreen];

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill includes example <help_response> templates with Chinese-language content, which can steer downstream subagents to reply in Chinese even when the user has not requested that locale. In an agent skill that orchestrates multi-step implementation and review, this can degrade operator oversight, cause misunderstandings, and bypass expected language-policy or audit conventions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains core operational instructions and examples in Chinese, including priority descriptions, escalation fields, and response templates. Because the file does not state that the skill is region-specific or provide an opt-in language choice, it creates a language/locale policy issue by implicitly forcing a specific language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains substantial operational instructions and examples only in Chinese, including priority definitions, escalation types, and required response formats. Because the skill does not offer the user or subagent a language/locale choice or explain that it is intended for a Chinese-speaking environment, it creates a language-policy mismatch.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This markdown file includes substantial operational guidance, escalation criteria, and required message templates only in Chinese. That creates a language/locale constraint for users or subagents without any opt-in, alternative language, or documented justification, which fits the policy-violation category for forced language use.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

</help_response>

text

**scope** → Either expand scope or handle it yourself

<help_response> <scope_decision>expanded | separate_task | lead_handles</scope_decision>

Static analysis

No suspicious patterns detected.