T01 · Skill Instruction Hijacking
Error
- Location
skills/super-dev-orchestrator/SKILL.md:4- Finding
Always-On Skill Hijacks Agent Workflow and Completion Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
SuperDev
Security checks for vulnerabilities and agentic risk
Overview
This development suite is not clearly malicious, but it needs Review because it auto-activates broad workflows, persists global memory, and may run unpinned external scanner tools.
Install only if you want an always-on development workflow that can read and write persistent memory across tasks. Review the memory path and disable or scope persistence if possible, require confirmation before memory writes and external scanner execution, and pin or sandbox any npx-based security tools before using the security gate.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
skills/super-dev-evolution/SKILL.md:18- Finding
Untrusted Task Content Can Be Converted into Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
skills/super-dev-security/SKILL.md:40- Finding
Security Workflow Executes Unpinned Third-Party Packages through npx
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (106)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Uninstalling
bash rm ~/.agents/skills/super-dev-skillsOptionally delete the clone:
rm -rf ~/.codex/super-dev-skills.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
rm ~/.agents/skills/super-dev-skills
text Optionally delete the clone: `rm -rf ~/.codex/super-dev-skills`.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
rm ~/.agents/skills/super-dev-skills
text Optionally delete the clone: `rm -rf ~/.codex/super-dev-skills`.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
macOS / Linux
bash rm -rf ~/.cursor/super-dev-skillsWindows (PowerShell)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 75% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
}
text > **Note:** Creating symbolic links on Windows may require administrator privileges or Developer Mode enabled. Restart OpenCode to discover the skills. Verify by asking: "List available skills"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
macOS / Linux
bash rm -f ~/.config/opencode/skills/super-dev-* rm -rf ~/.super-dev-skills
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
macOS / Linux
bash rm -f ~/.config/opencode/skills/super-dev-* rm -rf ~/.super-dev-skills
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash rm -f ~/.config/opencode/skills/super-dev-* rm -rf ~/.super-dev-skillsWindows (PowerShell)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash rm -f ~/.config/opencode/skills/super-dev-* rm -rf ~/.super-dev-skillsWindows (PowerShell)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash rm -f ~/.config/opencode/skills/super-dev-* rm -rf ~/.super-dev-skillsWindows (PowerShell)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash rm -f ~/.config/opencode/skills/super-dev-* rm -rf ~/.super-dev-skillsWindows (PowerShell)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash rm -f ~/.config/opencode/skills/super-dev-* rm -rf ~/.super-dev-skillsWindows (PowerShell)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash rm -f ~/.config/opencode/skills/super-dev-* rm -rf ~/.super-dev-skillsWindows (PowerShell)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README says users can 'directly say your development needs' and that the orchestrator will automatically identify a mode and activate multiple sub-skills. Broad natural-language triggers increase the chance of unintended activation of high-privilege behaviors, especially when combined with memory access and security-review delegation, creating a prompt-scope and overreach risk.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts { pattern: /-----BEGIN\s+(RSA|EC|DSA|OPENSSH)\s+PRIVATE KEY-----/g, name: "Private Key" }, { pattern: /mongodb(\+srv)?:\/\/[^:\s]+:[^@\s]+@/g, name: "MongoDB Connection String" }, ]; for (const f of [".env", ".env.local", ".npmrc"]) { const fp = path.join(targetPath, f); if (fs.existsSync(fp)) { try {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts { pattern: /-----BEGIN\s+(RSA|EC|DSA|OPENSSH)\s+PRIVATE KEY-----/g, name: "Private Key" }, { pattern: /mongodb(\+srv)?:\/\/[^:\s]+:[^@\s]+@/g, name: "MongoDB Connection String" }, ]; for (const f of [".env", ".env.local", ".npmrc"]) { const fp = path.join(targetPath, f); if (fs.existsSync(fp)) { try {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts { pattern: /-----BEGIN\s+(RSA|EC|DSA|OPENSSH)\s+PRIVATE KEY-----/g, name: "Private Key" }, { pattern: /mongodb(\+srv)?:\/\/[^:\s]+:[^@\s]+@/g, name: "MongoDB Connection String" }, ]; for (const f of [".env", ".env.local", ".npmrc"]) { const fp = path.join(targetPath, f); if (fs.existsSync(fp)) { try {
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger regex is very broad and the skill is also marked alwaysOn, so it can activate during ordinary conversation whenever common terms like '总结' or '经验' appear. That increases the chance of unintended execution, unsolicited memory/archive actions, and prompt-scope interference with other skills, especially because this skill is designed to collect and persist cross-task reflections.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is configured with
alwaysOn: trueand a.*trigger, causing it to activate for every task and context without scope restriction. In combination with its authority to read and write persistent.memory/files, this creates a broad attack surface for unintended data collection, prompt-context contamination, and persistence of untrusted content across sessions.- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest trigger pattern
.*causes this always-on orchestrator to activate for every user input, regardless of scope or relevance. In a skill system, this creates an over-privileged interception point that can preempt more specific skills, force unwanted workflow delegation, and expand the blast radius of any bad instruction or downstream skill behavior.- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger patterns are broad enough to activate on many ordinary requests such as '做一个' or '设计一个', causing this skill to intercept conversations outside its intended scope. Overbroad activation can degrade routing integrity, suppress more appropriate skills, and push users into a rigid workflow that gathers unnecessary project details.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts ## 安全配置硬化 ```bash # .npmrc ignore-scripts=true # .pnpmrc（如用 pnpm）
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
安全配置硬化
bash # .npmrc ignore-scripts=true # .pnpmrc（如用 pnpm）
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger regex and description are extremely broad, causing the skill to activate on nearly any coding-related request, including bug fixes and testing. Overbroad activation increases the chance this skill takes control in contexts where its constraints are inappropriate, leading to prompt-routing errors, suppression of needed security review, or unsafe code changes without the right specialist skill involvement.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger regex is broad enough to activate on many ordinary requests about pages, UI, or checking something, which can cause this skill to hijack unrelated conversations. Because the skill is explicitly scoped to 'only find problems' and excludes other responsibilities, accidental activation can derail user intent, suppress more appropriate skills, and create unsafe or misleading routing behavior in a multi-skill agent.
- Content