Security audit

This skill provides a complete multi-agent collaboration system for product-driven development loops

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent multi-agent development workflow, but it grants broad repository, shell, remote push, and persistent-instruction authority without enough scoping or approval gates.

Install only in repositories where you are comfortable with agents reading persistent project memory and shared documents, writing workflow files, running shell commands, committing, pushing branches, and potentially operating on main. Use branch protections, review generated MEMORY/SOUL/BOOTSTRAP files before sessions, require explicit approval for git push or merges, and avoid using web-search roles with confidential topics unless queries are sanitized.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:64
Finding: Authoritative startup files allow workspace-controlled instruction hijacking
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: skills/devloop-workflow/references/collaboration-protocol.md:5
Finding: Unauthenticated cross-agent messages and shared documents can propagate injected instructions
Content: View full analysis
: "" ## Usage rules 1. **The writer is responsible for notification** — after writing to `shared/`, the writer must notify the recipient through `sessions_send` 2. **Read-only consumption** — recipients only read files in `shared/` and do not modify them 3. **Message-based transfer** — when direct writing to another Agent's `shared/` is unavailable, pass the file content through `sessions_send` 4. **Do not assume paths** — do not use paths such as `../other-agent/workspace/`; all cross-Agent file exchange occurs through `shared/` or sessions ## Message routing table | Source | Trigger | Target | Message content | | Product | PRD confirmed | Core Dev | New product requirement is ready; inspect the PRD for architecture and task decomposition | | Core Dev | Task assignment | Dev | Task, design-document path, branch, and notes | | Core Dev | Testing ready | Test | PR branch and design-document path | | Dev | Development complete | Core Dev | Feature, dimension, branch, and changed-file count | | Dev | PR ready | Test | PR branch and design-document path | ``` ### Technical Analysis The collaboration protocol treats messages and shared documents as trusted operational input. It allows complete file contents to be transmitted through `sessions_send`, but it does not define: - Sender authentication or authorization. - Message signatures or integrity checks. - A strict schema for accepted fields. - Path validation. - Separation between descriptive data and e ...[truncated 2141 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: agents/devloop-core-dev.md:3
Finding: Bash and repository permissions are broader than the workflow technically enforces
Content: View full analysis
git commit -m "feat(): " git push origin feat/ ``` ```yaml # agents/devloop-test.md:5 tools: Read, Write, Edit, Bash, Glob, Grep ``` ```markdown # skills/devloop-workflow/references/agent-design-background.md:75-77 - Has all tool permissions, including exec/Bash, because the technical lead must directly develop core modules - May operate directly on the main branch for emergency fixes and infrastructure setup - It is recommended that exec/Bash be limited to Git and build commands ``` ### Technical Analysis Core Dev, Dev, and Test all receive general-purpose Bash access. The documentation recommends limiting Core Dev shell activity to Git and build commands, but no technical allowlist or sandbox is defined. A recommendation in an instruction file does not enforce command ...[truncated 2158 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (29)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation text is very broad: it says the skill should be used for setup, understanding, troubleshooting, resolving responsibility questions, and customizing agent behavior. That increases the chance the system invokes this skill in loosely related contexts, causing unnecessary loading of extensive workflow instructions and potentially influencing agent behavior beyond the user's actual intent. In a multi-agent orchestration skill, over-activation can expand the instruction surface and increase the risk of unintended delegation or context contamination.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill content is written as a Chinese-first workflow document without any indication that language should follow the user's preference. In practice, this can bias downstream agent responses and collaboration artifacts into a language the user did not request, reducing transparency and increasing the chance of misunderstandings in design, testing, or operational steps. The risk is limited because this is primarily a usability and control issue rather than direct code execution or data exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language content of the skill is written entirely in Chinese and the role/instructions implicitly prescribe Chinese interaction, but there is no opt-in or alternative language choice for users. Under the locale policy, forcing a specific language without user choice is a policy concern unless clearly documented as region-specific or optional.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly authorizes direct development on the main branch and automatic updates to shared project documentation/indexes without requiring an explicit user confirmation or warning at the point of execution. In an agentic workflow, this increases the chance of unintended destructive or hard-to-revert changes to production-trusted branches and shared coordination artifacts, especially when the agent is empowered to write files autonomously.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill description and operating instructions are written entirely in Chinese and prescribe agent communications in Chinese, including status and escalation messages. There is no indication that the user can opt into another language or that the Chinese-only constraint is region-specific and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The workflow instructs the agent to run git add/commit/push, including pushing to a remote branch, without any explicit requirement to warn the user or obtain approval for network-affecting repository updates. This can lead to unintended publication of code, leakage of sensitive work-in-progress, or unauthorized remote changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The direct user mode explicitly tells the agent to execute coding changes immediately for simple requests and bug fixes, but it does not require confirming that repository files will be modified or that branch operations may occur. In an agent with Write and Bash tools, this increases the risk of unexpected state-changing actions from ambiguous or casual user prompts.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill declares a constraint of 'read-only' and 'does not modify code', but the workflow repeatedly instructs the agent to write and update repository files such as MEMORY.md, memory/*.md, and project knowledge-base documents. This mismatch can mislead users or orchestration systems into granting broader file-write behavior than expected, weakening safety assumptions and enabling unintended repository modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to create and update numerous repository files such as test specs, bug trackers, reports, and memory files, but it does not require user confirmation or provide a warning that running the workflow will modify project state. In an agent setting with Write/Edit tools enabled, this can lead to unintended repository changes, noisy commits, or corruption of project documentation if triggered in the wrong context or by an untrusted prompt.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description says the skill should be used when 'setting up or understanding' the workflow, 'troubleshooting inter-agent communication,' 'resolving agent responsibility questions,' or 'customizing agent behavior.' These activation conditions are broad and lack explicit boundaries or negative examples, which may cause the skill to match ordinary multi-agent or workflow-related conversations beyond this specific DevLoop system.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Most of the user-facing instructions and workflow descriptions are presented in Chinese, while the file does not indicate that Chinese is optional or required for a justified region-specific purpose. This can amount to a language policy violation because it implicitly forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire template is written in Chinese and provides no indication that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific context. This can violate language/locale policy because it imposes a specific language on users without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire template, including headings, field labels, and instructional comments, is written in Chinese with no indication that other languages are supported or that the user can opt into this locale. Per the policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire template content is written in Chinese, including headings, instructions, and field values, with no indication that users may choose another language or that the skill is intended only for a Chinese-language context. This creates a natural-language locale constraint that may violate organizational language-choice policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire review-notes template is written in Chinese and provides no indication that users may choose another language. This creates a natural-language locale constraint that appears mandatory rather than optional, which fits the policy-violation category for language or locale restrictions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown template forces a specific language/locale for all headings and field labels, which can violate language-choice policy when no user opt-in or justification is provided. The file contains no indication that it is intended only for Chinese-language users or a region-specific workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document explicitly permits the Core Dev agent to operate directly on the main branch for 'emergency fixes' and infrastructure work, but it does not require explicit user confirmation, branch protection, rollback guidance, or other repository safety controls. In an agent workflow, normalizing direct main-branch writes increases the chance of destructive or unintended changes being applied immediately to production-critical code without review.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The table at L017-L023 defines cross-agent writes into the target agent's shared/ directory, while the usage rule at L028 states receivers only read shared/ and do not modify it. These instructions conflict about whether agents are permitted to write into another agent's shared area, creating intent-level ambiguity in the collaboration protocol.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file uses Chinese for the substantive usage and workflow instructions, and does not indicate that the user can select another language or that the pack is intentionally restricted to a Chinese-speaking audience. Under the natural-language policy rule, forcing a specific language without opt-in is a policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The workflow requires web_search and web_fetch on user-supplied topics without warning that those queries and fetched URLs may be sent to third-party services. If users provide confidential product ideas, internal codenames, customer names, or undisclosed architecture details as research topics, the agent could expose sensitive information externally during the search process.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill instructs the agent to persist research reports and memory files (reports/..., memory/..., MEMORY.md) without any explicit user-facing notice or consent flow. In a research workflow, prompts may contain proprietary topics, internal product plans, or sensitive investigative notes, so silent persistence can create privacy, retention, and cross-session data leakage risks.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file presents a complete research workflow and explicitly says the agent should notify the requester via sessions_send, but the manifest only declares Read, Write, WebSearch, and WebFetch. This creates a description-to-behavior mismatch because the documented workflow depends on a capability the skill does not actually expose in its declared interface.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description and the operational instructions are predominantly in Chinese, which can impose a language preference without explicit user opt-in. The policy requires either offering a language choice or clearly documenting and justifying a locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The template headings and field labels are written entirely in Chinese, which implies a fixed language requirement for the skill output. The policy allows locale constraints only when users are given a choice or the restriction is clearly justified, neither of which appears in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire template, including headings and field labels, is written in Chinese, which implies the skill expects or enforces Chinese-language reporting. The policy allows locale-specific behavior only when the constraint is explicitly documented and justified or when the user is given a language choice, neither of which is present in this file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.