Competitive Agent Loop

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:04 AM UTC
• Version: 2.0.1

Overview

This skill is a disclosed multi-agent development workflow, but it auto-routes project work to hard-coded QQ agent sessions without clear user-owned configuration or per-task consent.

Only install this if you control the listed QQ agent sessions and the described Workboard/Ollama environment. Otherwise, require the session keys and agent destinations to be user-configured, add explicit approval before any cross-session dispatch, and limit which repositories or tasks can trigger the loop.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:601

Finding

Automatic Task Redirection to Hard-Coded QQ Agent Sessions

Content

View full analysis

自动加载，不需要手动触发 ``` It requires tasks to be sent to predetermined QQ sessions: ```javascript // ---- Planner 侧：发任务到 coder 的 QQ 主会话 ---- sessions_send({ sessionKey: "agent:coder:qqbot:direct:3512d7045667f4df660228b731965c2", // coder 的 QQ 主会话 message: "执行阶段B: 实现方案，完成后调用 _workboard.workboard_complete 回填", timeoutSeconds: 300 // 等待 Worker 首次确认回复的时间，非执行时限（见 2.6） }); ``` Additional fixed destinations are embedded directly in the Skill: ```markdown **各 agent 的 QQ 主会话 sessionKey（固定）：** - coder: `agent:coder:qqbot:direct:3512d7045667f4df660228b731965c2` - checker: `agent:checker:qqbot:direct:3c2515212bbbed28731e70ef0dd5af4f` - memowriter: `agent:memowriter:qqbot:direct:fa5ee4a0bb61c7da1cf68a3cc87fc801` ``` The dispatch template restricts recipient agents from independently handling the task: ```markdown Planner 发出的任务消息必须包含明确指令，要求 worker 严格按 competitive-agent-loop 技能执行对应阶段步骤，禁止 worker 自己另起逻辑、跳步或自由发挥： 【任务：阶段X - <角色名> <动作>】 按 competitive-agent-loop 技能执行，不要自行处理其他逻辑或跳步。 ## 前置门禁检查（先做，不通过禁止开工） - 确认上一阶段（<上一阶段名>）的门禁凭证齐备（对照 SKILL.md 门禁凭证表逐项核验） - 凭证不齐 -> 回复 Planner 缺失项，拒绝开工，禁止自己补做或跳过上一阶段 - 凭证齐备 -> 在回复中声明"门禁通过"，再继续 ``` ### Technical Analysis The Skill combines automatic activation with mandatory `sessions_send` calls targeting hard-coded, author-specific QQ session identifiers. These destinations are not derived from user configuration, dynamically validated ownership, or selected with per-task user consent. Development requests may contain proprietary source code, acceptance criteria, architecture details, defects, repository paths, and other sensitive context. The documented workflow directs that context into the fixed Coder, Checker, and Memowriter sessions. It als ...[truncated 2214 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The statement that the skill auto-loads without manual triggering establishes an implicit activation model with no meaningful user confirmation barrier. Because this skill can dispatch work to other agents and drive a complex autonomous loop, accidental activation could lead to unintended code changes, task creation, or review workflows in contexts where the user did not consent to such orchestration.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is configured to auto-apply to broad programming and development tasks with only vague complexity and goal criteria, which can cause it to activate unexpectedly on sensitive repositories or privileged workflows. In this context, the skill orchestrates multi-agent execution, task dispatch, code generation, testing, and status transitions, so overbroad activation materially increases the chance of unsafe autonomous actions without explicit user intent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · examples/rest-api-example.md (reported line 28)May include surrounding context.

md

| AC-001 | POST /users creates user, returns 201 + new object | curl test + response parse |
| AC-002 | GET /users returns array of users | curl test + JSON validation |
| AC-003 | PUT /users/:id updates user, returns 200 | curl test + DB check |
| AC-004 | DELETE /users/:id removes user, returns 204 | curl test + DB verify |
| AC-005 | Input validation returns 422 with error details | malformed input test |

## Execution Flow

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire skill is written as Chinese-only operational guidance and does not indicate that language is selectable or based on user preference. For a general-purpose development orchestration skill, this creates a natural-language locale constraint without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The execution principles state that cross-agent information exchange must go through workboard comments and forbid direct state sharing through the filesystem or memory. However, later sections require Coder, Checker, and Memowriter to exchange substantive outputs through shared repository paths such as repo/tests/, repo/doc/reviews/, and repo/doc/, which are then consumed by other agents. That is an active contradiction in the documented intent, not merely an omission.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The isolation section explicitly says agents do not share conversation history and exchange state only through the filesystem and Workboard. This conflicts with earlier normative language that cross-agent information exchange must use workboard comments and that filesystem sharing is prohibited. The two instructions prescribe incompatible mechanisms for agent-to-agent state transfer.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.