T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:52- Finding
Unredacted task context may be disclosed to external cloud models
- Content
View full analysis
- Remediation
View remediation
Security audit
Subagent Orchestration
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent and not malicious, but it gives agents broad delegation patterns that can run local file/script operations and send inline context to web or cloud-model subagents without enough safety guidance.
Install only if you are comfortable with agents delegating local file/script work and sending selected task context to web tools or cloud-hosted models. Do not include secrets, credentials, private keys, customer data, regulated data, or proprietary material in delegated tasks unless you have explicitly approved that exposure and trust the configured providers. Verify the companion council skill and prefer pinned versions where available.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:151- Finding
Unpinned third-party Skill installation creates a supply-chain risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README recommends worker subagents for file operations, script execution, and shell commands, but it does not warn that these actions can modify files, execute arbitrary local code, or change system state. Because this skill is specifically about delegation patterns, users may treat the examples as safe defaults and authorize powerful local actions without guardrails, increasing the risk of destructive or unintended changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly encourages spawning web-enabled researcher subagents with externally connected tools, but it omits any warning that task text, search queries, fetched URLs, and embedded user data may be transmitted to third-party services. In an orchestration skill, this increases the chance that users delegate sensitive prompts, internal URLs, tokens, or proprietary context to external web tools without realizing the data exposure boundary.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata description includes a very broad trigger list such as "spawn," "delegate," and "council," which are common terms that may appear in many unrelated user requests. Overbroad activation can cause this skill to be invoked in contexts where subagent orchestration guidance is unnecessary, increasing the chance of inappropriate delegation patterns, accidental tool use, or interference with more relevant skills.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Council (Multi-Model Deliberation)
text # Spawn 3 parallel subagents with different models and perspectives # See skills/council-of-llms/SKILL.md for full details sessions_spawn(model: "ollama/kimi-k2.6:cloud", label: "Council-Strategos", ...) sessions_spawn(model: "ollama/deepseek-v4-pro:cloud", label: "Council-Analyticos", ...) sessions_spawn(model: "ollama/gemma4:31b-cloud", label: "Council-Creativos", ...)
Static analysis
No suspicious patterns detected.