Council Pilot

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:55 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it grants a highly autonomous agent broad power to research the web, change code, persist logs, and submit GitHub PRs without strong approval gates.

Review this skill before installing in any sensitive repository. Use it only on repos you are comfortable letting an autonomous agent modify, and require manual approval before file writes, git commits, pushes, or PR creation. Do not commit generated forum data or build logs until they have been checked for secrets, private code, internal paths, and unwanted source-derived content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: agents/profile-distiller.md:31
• Finding: Indirect Prompt Injection Through Persistent Web-Derived Expert Profiles## Vulnerability Details **File Location**: `agents/profile-distiller.md:31-66`, with the resulting profiles consumed by `agents/project-builder.md:20-47` **Vulnerability Type**: Indirect prompt injection through untrusted web content **Risk Level**: High ### Vulnerable Instructions `agents/profile-distiller.md:31-66` directs the agent to read arbitrary web content and convert it into persistent operational guidance: ```markdown ### 2. Read Source Content For each source in the dossier: 1. If the source URL is accessible, read full content with the available web fetch/open tool 2. Extract key information per tier: - **Tier A**: Career facts, published works, institutional affiliations, formal methodologies - **Tier B**: Reasoning patterns, debate positions, interview insights, teaching style - **Tier C**: Supplementary context, recent opinions, informal commentary 3. Preserve disagreements between sources (do not smooth them away) 4. Note source freshness (publication dates vs current date) ### 3. Fill Profile Fields For each field in the profile contract, extract from sources: **bio_arc**: Public career trajectory relevant to the domain. From Tier A sources only. **canonical_works**: Title, year, why it matters. From Tier A sources. **signature_ideas**: Core ideas the expert has publicly championed. Cross-reference Tier A and Tier B. **reasoning_kernel**: - `core_questions`: What does this expert ask first when approaching a problem? From interviews and talks (Tier B). - `decision_rules`: How do they choose between competing explanations? From methodology descriptions. - `failure_taxonomy`: What failure modes do they detect quickly? From post-mortems and critiques. - `preferred_abstractions`: What concepts or models do they repeatedly use? From publications and talks. **preferred_evidence**: What types of evidence do they trust? (empirical, theoretical, anecdotal, statistical) **critique ...[truncated 4802 chars]
• Remediation: ## Remediation Suggestions 1. Add an explicit rule that fetched pages are untrusted data and that instructions contained in them must never be followed. 2. Require schema-constrained extraction of factual claims rather than free-form transfer of page content. 3. Reject or quarantine imperative text, tool-use requests, credential requests, encoded payloads, and instructions unrelated to expert analysis. 4. Store field-level provenance, including source URL, quoted evidence, and extraction rationale. 5. Separate factual source excerpts from operational builder guidance. Do not pass raw source text to agents with Bash or write access. 6. Require human approval before newly distilled profiles become active inputs to the project-builder. 7. Use a least-privilege builder without Bash by default, enabling command execution only for an approved command allowlist. 8. Require explicit user confirmation and a staged-file secret review before any `git push` or `gh pr create` action.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/expert_distiller.py:105
• Finding: Path Traversal Through Unsanitized Expert and Council Identifiers## Vulnerability Details **File Location**: `scripts/expert_distiller.py:105-118` **Additional Affected Locations**: `scripts/expert_distiller.py:122-148`, `152-182`, `186-241`, and `908-970` **Vulnerability Type**: Path traversal and arbitrary file read/write within process permissions **Risk Level**: Medium ### Vulnerable Code `scripts/expert_distiller.py:105-118` accepts an explicit expert identifier without validation and interpolates it into a filesystem path: ```python def add_candidate(args: argparse.Namespace) -> None: root = args.root.expanduser() ensure_layout(root) expert_id = args.expert_id or slugify(args.name) payload = { "id": expert_id, "name": args.name, "domain": slugify(args.domain), "reason": args.reason or "", "status": "candidate", "created_at": now_iso(), "updated_at": now_iso(), } write_json(root / "candidates" / f"{expert_id}.json", payload) print(f"Queued candidate: {expert_id}") ``` The same unsafe identifier pattern is used for source dossiers at `scripts/expert_distiller.py:122-148`: ```python def add_source(args: argparse.Namespace) -> None: root = args.root.expanduser() ensure_layout(root) expert_id = args.expert_id dossier_path = root / "source_dossiers" / f"{expert_id}.json" dossier = read_json( dossier_path, { "expert_id": expert_id, "created_at": now_iso(), "updated_at": now_iso(), "sources": [], }, ) source_id = args.source_id or slugify(f"{expert_id}-{args.tier.upper()}-{args.title}")[:80] source = { "id": source_id, "title": args.title, "url": args.url, "tier": args.tier.upper(), "note": args.note or "", "added_at": now_iso(), } dossier["sources"] = [item for item in dossier.get("so ...[truncated 4285 chars]
• Remediation: ## Remediation Suggestions 1. Validate all externally supplied identifiers with a strict allowlist such as: ```python ID_PATTERN = re.compile(r"^[a-z0-9][a-z0-9-]{0,79}$") ``` 2. Reject identifiers containing path separators, `..`, absolute paths, drive prefixes, null bytes, or unsupported Unicode separator characters. 3. Apply validation consistently to `expert_id`, `source_id`, `council_id`, and any identifier loaded from persisted JSON. 4. Resolve every generated path and verify containment before access: ```python def safe_child(base: Path, name: str) -> Path: if not ID_PATTERN.fullmatch(name): raise ValueError("Invalid identifier") base_resolved = base.resolve() candidate = (base_resolved / name).resolve() if candidate != base_resolved and base_resolved not in candidate.parents: raise ValueError("Path escapes configured root") return candidate ``` 5. Use the safe-path helper for both reads and writes; validation only at initial record creation is insufficient because persisted records can also be modified externally. 6. Avoid automatically creating parent directories for paths that have not passed containment validation. 7. Add regression tests covering `../`, nested traversal, absolute paths, Windows-style separators, symlink escapes, and malicious identifiers loaded from dossiers. 8. Where practical, open files relative to a trusted directory descriptor and disallow symlink following to reduce time-of-check/time-of-use and symlink traversal risks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The description substantially overstates autonomy and implemented scope. The code does align with parts of the expert-forum and maturity-scoring concept: it manages candidate experts, source dossiers, promotion audits, councils, coverage analysis, artifact scoring, and reporting. However, the major promised capabilities are absent from this chunk: no real web sourcing, no autonomous expert distillation from the web, no actual project generation or debugging, no adversarial loop that drives scores to 100 automatically, and no GitHub submission. The code itself repeatedly notes that several functions are only placeholders for 'SKILL mode' and that standalone mode cannot run the LLM council or builds. Therefore the declared description does not accurately represent what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a broad autonomous system that researches experts from the web, builds projects end-to-end, iteratively debugs/rescores them to perfection, and submits to GitHub. The actual code chunk is only a test file that exercises a CLI around expert/forum setup and standalone scoring of a local markdown artifact. While some terms overlap with the description (experts, council, scoring), the implemented behavior shown here is materially narrower and different in primary purpose: validating that scoring reads an artifact, emits a real report, and saves pipeline state. Several headline capabilities from the description are absent from the code chunk, especially autonomous code building, iterative maturity optimization, and GitHub submission.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill advertises fully automated code writing and GitHub submission without clearly warning the user that it may modify local repositories and create remote pull requests. In context, this is dangerous because the skill is framed as end-to-end autonomous and includes Bash, Write, Edit, and gh usage, so a user could trigger impactful changes without informed consent.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The Submission phase includes git push and gh pr create without an explicit confirmation requirement, which could publish code, leak sensitive content, or create external-facing artifacts unexpectedly. Because the skill is autonomous and has Bash plus gh access, this crosses a trust boundary from local work to remote side effects and is high risk without a human approval checkpoint.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly states the skill will 'submit a PR' after autonomous build/debug loops, but it does not clearly warn users up front that repository-modifying actions such as branch creation, push, and PR submission may occur. In an autonomous coding skill, this can lead to unexpected writes to a user's repository or remote origin, which is risky because the user may invoke it assuming analysis-only behavior.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

| `index` | Rebuild forum index |
| `validate` | Validate profile completeness |
| `discover` | Discover candidates from file or SKILL mode |
| `fill` | Output fill prompt for profile distillation |
| `council` | Manage councils (create/add-member/list/show) |
| `score` | Score artifact against expert council |
| `coverage` | Analyze expert coverage gaps |

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

| `index` | Rebuild forum index |
| `validate` | Validate profile completeness |
| `discover` | Discover candidates from file or SKILL mode |
| `fill` | Output fill prompt for profile distillation |
| `council` | Manage councils (create/add-member/list/show) |
| `score` | Score artifact against expert council |
| `coverage` | Analyze expert coverage gaps |

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

| `index` | Rebuild forum index |
| `validate` | Validate profile completeness |
| `discover` | Discover candidates from file or SKILL mode |
| `fill` | Output fill prompt for profile distillation |
| `council` | Manage councils (create/add-member/list/show) |
| `score` | Score artifact against expert council |
| `coverage` | Analyze expert coverage gaps |

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

| `index` | Rebuild forum index |
| `validate` | Validate profile completeness |
| `discover` | Discover candidates from file or SKILL mode |
| `fill` | Output fill prompt for profile distillation |
| `council` | Manage councils (create/add-member/list/show) |
| `score` | Score artifact against expert council |
| `coverage` | Analyze expert coverage gaps |

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

| `index` | Rebuild forum index |
| `validate` | Validate profile completeness |
| `discover` | Discover candidates from file or SKILL mode |
| `fill` | Output fill prompt for profile distillation |
| `council` | Manage councils (create/add-member/list/show) |
| `score` | Score artifact against expert council |
| `coverage` | Analyze expert coverage gaps |

• Confidence: 85% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Session Persistence

Medium

• Category: Rogue Agent

Content

| Max iterations (default: 10) | Pause, generate report, print state |
| Build failure (3 retries) | Log failure, feed to gap analyst |
| Score regression (>10 points) | Pause, revert to previous artifact |
| Context window pressure | Write state to disk, compact, resume |

## Trust Model

• Confidence: 81% confidence
• Finding: Persisting pipeline state to disk is not inherently unsafe, but in this skill's context it may serialize prompts, project state, build context, source metadata, and possibly sensitive repository details for later resumption. If those artifacts are stored without minimization, access controls, or retention guidance, they can expose confidential code, secrets, or operational history to other local users or later processes.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger conditions are broad enough to activate on generic requests like 'build with experts' or 'full auto build,' increasing the chance the skill is invoked in contexts the user did not intend. In a skill that claims repository modification, autonomous building, and submission behavior, ambiguous activation materially raises the risk of unintended execution and unsafe actions.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

- Grep
  - Glob
  - Agent
model: opus
argument-hint: "<domain-or-idea> [--target-repo URL] [--max-iterations N] [--quick]"
---

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The Build phase instructs the agent to generate and write code into the target repository path but does not require an explicit warning or confirmation before altering files. In an autonomous pipeline, silent repository mutation can overwrite work, introduce insecure code, or affect unintended directories if the target path is wrong.

Session Persistence

Medium

• Category: Rogue Agent

Content

| Max iterations reached | Pause, generate report, print current state |
| Build failure after 3 retries | Log failure, continue to GAP_FILL |
| Score regression (>10 points) | Pause, revert to previous artifact |
| Context window pressure | Write state to disk, compact, resume |

## Search Tools

• Confidence: 76% confidence
• Finding: The instruction to write state to disk and resume later creates persistence of operational context, which may include repository paths, score history, failure details, and potentially sensitive project metadata. In an autonomous build-and-submit workflow, unbounded session persistence increases the chance of leaking sensitive information across runs or leaving recoverable artifacts on disk.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file states that for each source, the agent should read full content from accessible source URLs using a web fetch/open tool. However, the manifest only declares Read, Write, Grep, Glob, and Bash, which are local/file and shell-oriented capabilities, creating a mismatch between the described behavior and the actual declared code/tool operations.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill metadata and default prompt authorize highly autonomous, open-ended behavior: building an expert council, driving a project to production maturity, and iterating until a perfect score is reached. This is dangerous because it lacks scope limits, approval gates, and task boundaries, increasing the chance of unsafe actions, uncontrolled tool use, or execution beyond the user’s intended objective.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documented build log format stores raw stdout and stderr for automated build, test, and debug stages, which commonly contain secrets, tokens, environment values, stack traces, internal paths, or proprietary source fragments. In this skill’s fully autonomous build-and-debug loop, repeated logging across many tools and retries increases the chance of persistent sensitive-data capture and later leakage through artifacts, reviews, or repository submission.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The submission instructions explicitly require committing the full expert forum data, scoring history, pipeline state, and build logs, while only excluding a narrow set of paths like .env files. In an autonomous research-and-build pipeline, those artifacts can easily contain personal data from scraped expert profiles, proprietary prompts, internal URLs, access tokens in logs, or other sensitive operational metadata, so publishing them to GitHub creates a realistic data exposure risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The SUBMIT phase explicitly performs repository-modifying actions (create branch, commit, push, create PR) in a fully autonomous pipeline, but the state machine describes no explicit user consent, authorization check, dry-run default, or confirmation gate before those actions occur. In the context of this skill, which is designed to iterate autonomously until convergence and then submit to GitHub, this creates a real risk of unauthorized code pushes, unwanted PR spam, or exfiltration of generated content into user repositories.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest claims autonomous expert distillation from web sources. However, the discover command in this file either reads structured candidates from --from-file or exits with a message saying web search is only handled under SKILL mode; there is no actual web retrieval or source discovery implemented here.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest describes a fully autonomous engine that builds project code, debugs in a loop, and eventually submits to GitHub. In this file, the build command merely updates pipeline state and writes a JSON build-context log, with the docstring explicitly noting that the actual build runs elsewhere.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

class StandaloneScoreTest(unittest.TestCase):
    def run_cli(self, *args: str, cwd: Path | None = None) -> subprocess.CompletedProcess[str]:
        return subprocess.run(
            [sys.executable, str(SCRIPT), *args],
            cwd=cwd,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The README discusses discovering experts from public sources and web-searching for domain experts, but it does not provide a clear operational warning that the skill performs outbound web requests and collects public-source data during execution. This matters because users may run the skill in restricted, confidential, or regulated environments where network access and data collection need explicit awareness and consent.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: This markdown skill instructs the agent to write `scoring_reports/<domain_id>_<timestamp>.json`, which is a file-system side effect. The description does not warn the user that running the skill will create or modify files, so the write behavior is not clearly disclosed.

Static analysis

No suspicious patterns detected.