Security audit

Kernelgen Flagos

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent kernel-generation purpose, but it asks for broad repository mutation, external code generation, automatic execution, plaintext token storage, and optional remote publishing workflows that need careful review before use.

Install only if you are comfortable sending kernel source and repository details to the KernelGen MCP service, storing a bearer token in a project-local config file, and letting the agent edit and execute generated code. Use a clean branch, avoid repositories with secrets, keep .mcp.json out of git, review diffs before running generated code, and decline PR/chat publishing unless you have checked the exact files and destination.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: kernelgen-optimize.md:394
Finding: Remote MCP Payloads Are Written and Executed Locally
Content: View full analysis
&& ${PYTHON_CMD} -m pytest test_*.py -v 2>&1 ``` Equivalent remote-write-and-execute behavior is also present in the generation, specialization, FlagGems, and vLLM workflows. For example, `kernelgen-specialize.md:80-125` directs the Agent to save MCP-returned code and automatically execute tests and benchmarks. ### Technical Analysis The workflow sends source code to an external KernelGen MCP service and accepts a complete replacement Python/Triton implementation in response. It then writes that response into a local source file and executes project tests that import or invoke the modified implementation. The effective executable payload is therefore controlled by a remote service and can change after the Skill package has been audited. The documented syntax, complexity, interface, and known-defect checks are insuffi ...[truncated 1741 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: kernelgen-optimize-for-vllm.md:3
Finding: Blanket Authorization Bypasses Review of Remote Code Changes and Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: kernelgen-mcp-setup.md:37
Finding: KernelGen Bearer Token Is Stored in a Project-Local Plaintext File
Content: View full analysis
" } } } } ``` ```text **Write logic**: 1. Use the Read tool to check whether `.mcp.json` already exists 2. **If the file already exists**: - Read and parse the JSON - If the `mcpServers` key already exists, merge `"kernelgen-server": {...}` into it — **do not delete any other existing MCP service entries** - If the `mcpServers` key does not exist, create it and add the `kernelgen-server` entry - Use the Edit tool to update the file 3. **If the file does not exist**: - Use the Write tool to create the file with the complete JSON above ``` ### Technical Analysis The workflow asks the user to paste a bearer token into the conversation and then embeds it directly in `.mcp.json` under the current project. Bearer tokens provide access to anyone who possesses them, so plaintext persistence creates a reusable credential artifact. The Skill does not require restrictive file permissions, verify that `.mcp.json` is excluded from version control, use a secret manager, or warn that the file contains a credential. Because the file is project-local, it may be included in commits, repository archives, support bundles, backups, or shared workspaces. The instruction to inspect only project-local files reduces unrelated credential access but does not protect the newly written token. ### Attack Path 1. The Skill asks the user to paste a KernelGen token. 2. The user supplies the bearer token in ...[truncated 869 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: kernelgen-optimize-for-vllm.md:126
Finding: Optimization Workflows Automatically Install Unpinned Dependencies
Content: View full analysis
/dev/null | grep -oP "release \K[\d.]+" ``` ```text **2. Create Conda Environment** ``` ```bash ENV_NAME="vllm_opt_env" conda create -n ${ENV_NAME} python=3.10 -y ``` ```text **3. Install PyTorch (select wheel based on CUDA version)** | CUDA Version | Install Command | |-------------|----------------| | 11.8 | `conda run -n ${ENV_NAME} pip install torch --index-url https://download.pytorch.org/whl/cu118` | | 12.1 | `conda run -n ${ENV_NAME} pip install torch --index-url https://download.pytorch.org/whl/cu121` | | 12.4+ | `conda run -n ${ENV_NAME} pip install torch --index-url https://download.pytorch.org/whl/cu124` | | Uncertain | Ask the user to provide the correct torch install command | **4. Install Remaining Dependencies** ``` ```bash conda run -n ${ENV_NAME} pip install triton pytest numpy ``` Similar unpinned installations occur in `kernelgen-optimize.md:62-152` and `kernelgen-optimize-for-flaggems.md:104-167`, including packages such as `scikit-build-core`, `pybind11`, `ninja`, `cmake`, `scipy`, `PyYAML`, `sqlalchemy`, and `packaging`. ### Technical Analysis The workflow automatically creates an environment and installs the latest versions satisfying broad or absent constraints. Package names such as `triton`, `pytest`, and `numpy` are installed without exact versions or integrity hashes. Python packages can execute code during build, installation, import, and plugin discovery. Consequently, package-index co ...[truncated 1656 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (62)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Automatic pull request submission is a high-risk capability because it can publish code changes to remote repositories and trigger CI, reviews, or downstream deployment workflows. In the context of a coding skill, this creates an opportunity for unintended disclosure, reputational damage, or propagation of unsafe code if the action is not tightly gated.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Sending modified files to chat applications is unrelated to kernel generation and creates a direct channel for code or sensitive content to leave the development environment. Because generated or modified files may contain proprietary source, credentials, or environment-specific information, this materially increases confidentiality risk.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
All sub-skill files are located in the **same directory** as this `SKILL.md` file.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented workflow includes inspecting git remotes, creating branches, committing, pushing to external hosting services, and opening PRs. Those actions can publish code and metadata to remote systems, alter repository state, and bypass normal human review if the skill is triggered in a sensitive or misconfigured environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill includes automated git remote inspection, branch creation, commit, push, and pull-request creation, which are repository-management actions outside the stated kernel-generation scope. These actions can modify version-control state and publish code or metadata to remote services, increasing the risk of unauthorized changes, data leakage, or supply-chain impact if triggered inappropriately.
Content: No source excerpt is available for this finding.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · kernelgen-generate.md (reported line 187)May include surrounding context.
md
`activation`, `blas`), proceed without warning — these have >90% success rate.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill extends beyond kernel generation into outbound messaging and git hosting automation, including sending client/team messages and creating branches, commits, pushes, and PRs. These actions can exfiltrate repository details or modify remote state, which is outside the declared purpose and creates an unnecessary capability escalation if the skill is triggered in a sensitive environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly authorizes using chat CLIs/APIs to send summaries and file information to external messaging platforms. That creates a direct exfiltration path for source code metadata, benchmark results, file paths, and potentially proprietary implementation details unrelated to kernel generation itself.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill instructs the agent to create branches, stage files, commit, push to remotes, and open PRs. This gives the skill repository-hosting side effects beyond code generation and can alter project history or leak code to external remotes if used against the wrong repository or remote configuration.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow directs automatic file writes, copying of files, test execution, benchmark execution, and report/README updates without any warning or confirmation. This is dangerous because it combines multiple side-effecting actions across the filesystem and execution environment, allowing repository-controlled content to influence what gets run and written.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README instructs users to connect to an external MCP service using a token, but it does not clearly warn that prompts, environment details, repository metadata, or file contents may be sent to that service. In a code-generation skill operating on source repositories, the absence of a privacy and data-handling notice increases the risk of unintentional disclosure of sensitive code or credentials.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README states the skill can automatically submit pull requests and send modified files to chat applications, which expands behavior beyond kernel generation/optimization into remote data exfiltration and repository-side effects. Even if framed as convenience features, these capabilities can expose source code externally or make unintended changes in remote systems if invoked without strong consent and scope controls.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README describes auto-setup that writes MCP client configuration files, which is a system-configuration action outside the core kernel-generation purpose. Automatic config modification can alter agent behavior, persist credentials, or connect the client to external services without sufficiently bounded user understanding.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Automatic writing of MCP client configuration files grants the skill persistent influence over tool configuration, which is not justified by its primary purpose. This is dangerous because config changes can silently redirect future sessions to external services or store connection details in local files, widening the blast radius beyond a single task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README describes automatic config writes and PR submission but does not give a prominent warning that local files and remote repositories may be modified. Lack of upfront disclosure undermines informed consent and makes accidental side effects more likely, especially in agent-driven environments where users may expect analysis rather than mutation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README instructs users to connect to a remote MCP service and describes repository inspection and operator generation workflows, but does not clearly warn that code snippets, file paths, prompts, environment details, or other project metadata may be transmitted to that external service. This can lead to unintentional disclosure of proprietary code or sensitive infrastructure information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README describes generated artifacts and automated repository integration, including injecting files into project directories, but does not clearly foreground that the skill will modify user repositories and may do so automatically. In an agentic coding context, insufficient disclosure increases the risk of unintended code changes, accidental overwrites, and users approving actions without understanding their scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README advertises automatic PR submission and sending modified files through chat applications, but does not provide adequate warning about data exfiltration, accidental publication to remote repositories, or disclosure through third-party messaging platforms. In a coding agent workflow, these actions can move sensitive code outside the local environment with little friction.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises broad natural-language triggers like 'generate an operator', 'create a kernel for X', and 'optimize triton kernel', which can cause the skill to activate on ordinary repository-assistance requests rather than explicit, informed invocation. Because the skill has write/edit capabilities and mandates use of an external MCP service, over-broad triggering increases the chance of unintended code changes or project data being sent to external infrastructure without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill declares powerful file-modifying tools (Write, Edit, Bash) but does not clearly warn users in the user-facing documentation that invoking it may modify repository files. This can lead to users triggering code generation or optimization workflows without understanding that the skill may alter source code, configuration, or tests, increasing the risk of unintended repository changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill makes external MCP usage mandatory for generation, optimization, and specialization, but does not clearly disclose to users that project information may be transmitted to an external service. In a codebase context, this is more dangerous because repository structure, source snippets, operator definitions, or performance-related code may be sent off-host, creating confidentiality and supply-chain exposure without informed consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction hardcodes a Chinese message for the user to follow when MCP setup fails. This imposes a specific language on the interaction without user opt-in, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: These lines instruct the agent to tell the user a specific Chinese sentence if MCP tools are unavailable. Because the skill mandates a single language for user communication and does not document a justified locale restriction, it violates the natural-language policy rule.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill expands beyond kernel generation into optional outbound messaging and pull request automation, adding capabilities unrelated to its declared purpose. This increases the attack surface because a user requesting harmless code generation could be steered into external communications or repository-modifying workflows that expose data or publish unreviewed changes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Authorizing chat-tool integrations allows the skill to transmit summaries, file paths, or results to third-party messaging platforms that are unrelated to kernel generation. Even with a confirmation prompt, this creates a clear path for exfiltration of sensitive repository details or benchmark results outside the local development environment.
Content: No source excerpt is available for this finding.