multi-role

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:43 AM UTC
• Version: 1.0.1

Overview

This skill is a broad multi-agent workflow system that fits its stated purpose, but it uses persistent logs, memory, delegated agents, and reduced user-facing detail in ways users should review carefully.

Install only if you are comfortable with a workflow skill that creates persistent project memory/log files, routes broad natural-language requests automatically, and may delegate code/file work to child agents. Keep it confined to a dedicated workspace, review its session/log directories periodically, avoid using private chat history or secrets as source material, and require explicit confirmation before child agents modify files, run commands, or update role rules.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:5

Finding

Skill-level instructions override session goals and suppress execution transparency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5, SKILL.md:101, SKILL.md:423-441; OUTPUT-RULES.md:1-43
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Snippets

The following are faithful English translations of the relevant instructions in SKILL.md:

markdown

> Before every response, `OUTPUT-RULES.md` must be read before producing
> any content. This is the highest-priority rule.

markdown

> Fundamental rule: All roles and all projects share this memory invocation
> specification. This is the globally highest-priority memory strategy.
> Every role onboarding, task execution, and context-loading operation must
> comply with it.

markdown

## Minimal Output Specification

The user only needs to know four things:
A. Understanding confirmation
B. Process confirmation
C. Execution status
D. Result summary

Prohibited in conversations:
- Original role declarations
- Step-by-step SOP details
- Code snippets and original test logs
- Process narration
- Complete file contents

All execution details must be written to
`sessions/{project}/task-logs/`.

The corresponding translated instructions in OUTPUT-RULES.md:1-43 state:

markdown

# Minimal Output Rules — highest priority and required before every response

Only output four elements; everything else is prohibited.

All execution details are written to
`sessions/{project}/task-logs/`.

Code-change details are written to task logs and are not included
in responses.

Technical Analysis

The Skill declares its own documentation to be the “highest-priority” and “globally highest-priority” instruction source. Skill content must remain subordinate to system, developer, and current user instructions. A Skill cannot safely redefine the instruction hierarchy merely by labeling its rules as higher priority.

The mandatory output policy compounds this i ...[truncated 1679 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove every “highest-priority” or “globally highest-priority” declaration from Skill files.
2. Add an explicit boundary such as:

   markdown

   These workflow recommendations are subordinate to system, developer,
   and current user instructions.
   

3. Convert the minimal-output rules into a default style preference rather than a mandatory restriction.
4. Allow users to request code, logs, file contents, action histories, and test evidence.
5. Always disclose security-sensitive actions, destructive operations, failures, and deviations from the requested task.
6. Do not penalize the agent for following higher-priority instructions or a user’s explicit request for detailed output.
7. Keep internal task logs as optional supporting records, not as a replacement for required user-facing disclosure.

T02 · Agent Memory Poisoning

Error

• Location: references/rules/记忆管理规范.md:116

Finding

Task-derived content can be promoted into persistent cross-session instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:84, SKILL.md:150-165, SKILL.md:266; references/rules/记忆管理规范.md:116-157, references/rules/记忆管理规范.md:239-246
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Vulnerable Snippets

The following are faithful English translations of the relevant instructions in SKILL.md:

markdown

Role reconstruction process:
Archive the predecessor's errors, write the lessons into the new
constitution, and have the new role complete the onboarding process.

markdown

Memory write rules:

| Trigger | Destination | Responsible role |
| Version iteration completed | context.md | Product Manager |
| A pitfall is encountered and solved | pitfalls.md | Development/Testing |
| Role reconstruction | role-extras/ | Chief Steward |
| Every two weeks | context.md | Product Manager |

markdown

Memory retention rules:
- context.md is condensed when it exceeds its limit.
- Old decisions are moved into archives.
- Resolved pitfalls are periodically removed.
- archives/ is retained permanently and is never evicted.

markdown

During role reconstruction:
1. Archive the predecessor's error records.
2. Write the predecessor's lessons into the corresponding section of
   the new constitution.
3. Load those records during onboarding of the new role.

The detailed memory policy in references/rules/记忆管理规范.md includes the following translated instructions:

markdown

| Event | File | Responsible role | Written content |
| Version iteration completed | context.md | Product Manager |
  Updated version, status, latest completion, and next step
| Major technical decision | decisions.md | CTO |
  Decision and one-sentence reason
| Pitfall solved | pitfalls.md | Development/Testing |
  Problem and solution
| Role reconstruction | role-extras/ | Chief Steward |
  Write predecessor lessons into the new const
...[truncated 2975 chars]

Remediation

View remediation

Remediation Suggestions

1. Never automatically promote task-derived material into constitutions, public rules, or other governing documents.
2. Require explicit, informed user approval for every role-policy modification.
3. Separate storage into distinct trust domains:
   • Immutable Skill policy.
   • User-approved configuration.
   • Untrusted project records.
   • Untrusted logs and external content.
4. Mark every stored entry with provenance, author, source task, timestamp, trust level, and expiration.
5. Store external and user-provided text as quoted data and prohibit the agent from interpreting it as an instruction.
6. Validate persistent records against strict schemas that reject tool directives, priority claims, hidden prompts, and requests to modify policy.
7. Review and sanitize summaries before they are loaded into later sessions.
8. Add integrity protection and version history for constitutions and public rules.
9. Provide a user-visible interface to inspect, approve, revoke, and delete persistent memories.
10. Apply retention limits to archived error material unless permanent retention is explicitly required and approved.
11. On session initialization, clearly instruct the agent that loaded project records are untrusted reference data subordinate to current instructions.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:208

Finding

Delegated sessions receive unrestricted tool permissions instead of task-scoped access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:208, SKILL.md:376-384
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Vulnerable Snippets

The following are faithful English translations of the relevant instructions in SKILL.md:

markdown

Parallel execution method:
Issue multiple Task tool calls in the same message without
`run_in_background`. They execute concurrently, and each task has
complete tool permissions.

markdown

## Child Session Execution Architecture — mandatory

The Chief Steward's main Session performs only decision-making and
scheduling. Development and testing execution, including reading and
writing files and running code, must be delegated to independent child
Sessions.

- After the PRD is approved, immediately start an independent child
  Session through coding-agent.
- The child Session returns a result summary to the main Session.
- The main Session reads only the summary and not the execution details.

Direct coding in the main Session is classified as a critical error.

Technical Analysis

The Skill explicitly grants every delegated task “complete tool permissions.” This violates least privilege because tool and filesystem access are not limited to the requirements of an individual task.

Mandatory delegation increases the risk: file reads, file writes, code execution, and testing are transferred to child sessions while the main session is instructed to review only a short summary. If a delegated prompt is compromised through user input or poisoned persistent memory, the child session can exercise all available tools rather than a minimal task-specific subset.

Concurrent execution further increases the potential scope by allowing several fully privileged tasks to act at the same time.

Attack Path

1. An attacker influences a task request, stored project context, task log, or role instruction. 2 ...[truncated 1361 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace “complete tool permissions” with task-specific capability grants.
2. Restrict each child session to an explicit project-root allowlist.
3. Grant read-only access by default and enable writes only for named files or directories.
4. Disable shell execution unless it is essential to the approved task.
5. Disable network, messaging, credential, and system-management tools by default.
6. Require explicit confirmation before destructive operations, access outside the project root, dependency installation, or execution of untrusted code.
7. Prevent child sessions from modifying Skill policies, constitutions, public rules, and persistent memory unless separately authorized.
8. Return a structured audit record containing tools invoked, files accessed, files modified, commands executed, and failures.
9. Do not limit the main session to a summary when elevated or security-sensitive actions occurred.
10. Apply concurrency controls so fully independent tasks cannot write to overlapping resources.
11. Enforce permissions at the runtime or sandbox layer rather than relying only on prompt instructions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (47)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file imposes a rigid Chinese-only, ultra-minimal output policy at the highest priority without any user opt-in or contextual fallback. This can override user language preferences and suppress normal transparency about actions taken, which increases the risk of misleading or non-consensual behavior and makes security-relevant agent activity harder for users to inspect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quick-start section encourages users to provide any natural-language request and implies the 'butler' will automatically select roles and begin processing, without documenting constraints or safe failure behavior. This broad triggering model is risky because it can cause accidental activation, unintended delegation across roles, and implicit execution of workflows from ambiguous user input.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README states that users can 'directly say what you want' and that the orchestrator will automatically analyze and route requests, but it does not define clear activation boundaries, scope limits, or non-trigger cases. In an agentic skill, overly broad natural-language triggering increases the chance the skill activates on unrelated prompts, performs unintended orchestration, or handles sensitive tasks without explicit user confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The spec explicitly instructs skills to automatically create and append to a persistent shared file, but it provides no user-facing disclosure, consent, or control over local file modification and retention. In an agent setting, this creates an unexpected persistence channel that can store task metadata across runs and skills, increasing privacy, integrity, and cross-task data leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code examples operationalize silent filesystem writes by showing mkdir and append behavior with no warning, confirmation, or safety checks. Because examples in a spec are likely to be copied directly into skills, this normalizes unauthorized local persistence and can lead to broad adoption of unsafe write behavior across the ecosystem.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file uses a hard requirement that the agent must read and obey Chinese-language output rules before replying, stated as the highest-priority rule. This imposes a language/locale constraint without any visible user opt-in or documented justification that the skill is region-specific.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The global memory and logging rules direct broad retention of system logs, memory, and task execution data across roles and projects. Without minimization, access control, redaction, and retention limits tied to data sensitivity, this creates a realistic risk that prior user inputs or sensitive project information will be surfaced to later tasks or users.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The mandatory workflow requires reading and updating accumulated project context, decisions, pitfalls, and related memory before task execution. This increases the chance of propagating sensitive historical content into new contexts, especially if project boundaries, role permissions, or sanitization are weak or inconsistently applied.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill mandates automatic cleanup of logs older than seven days without a warning or confirmation step. Automated deletion can destroy forensic evidence, audit history, or user data unexpectedly, especially when logs may contain debugging information needed for incident response or accountability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to silently create directories and session files during project startup. Silent filesystem modification without explicit user confirmation can lead to unauthorized writes, clutter, or persistence of sensitive project metadata in locations the user did not intend.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill contains conflicting operational requirements: earlier sections require loading all shared rules/SOPs during startup, while later sections prohibit full loading and require only task-needed materials. In practice, this ambiguity can cause inconsistent enforcement of safeguards, accidental overcollection of context, or omission of required constraints depending on which instruction an agent follows.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Directing all execution details into task logs for later lookup creates ongoing retention of potentially sensitive prompts, outputs, file paths, errors, and operational context. Even if intended for traceability, such logs can become a secondary disclosure channel if later read broadly by other roles, sessions, or users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description is entirely in Chinese and provides no indication that the skill supports other languages or that Chinese is an intentional, justified locale restriction. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file instructs that the first sentence at the start of every task "should be" a fixed Chinese sentence. This imposes a specific language on interactions without any opt-in or alternative locale handling, which is a natural-language policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document says the role must stop when tasks exceed its职责范围, but then imposes concrete file-editing and shell-operation behavior that exceeds the stated CTO remit. That contradiction can normalize privilege expansion: an agent told it is advisory may still perform operational changes, undermining separation of duties and making unsafe execution more likely in practice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The constitution explicitly mandates shell execution tools for routine file inspection and editing operations, even though the role is framed as a CTO/advisory architecture role. This broadens the agent’s operational authority and encourages use of more powerful primitives than necessary, increasing the risk of unsafe file-system access, unintended modification, or command misuse if the role is later invoked on untrusted paths or repositories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the role to inspect user history and system configuration to gather 'real cases' for content creation, but it provides no consent, minimization, or disclosure guardrails. That creates a privacy risk because the agent may access and repurpose sensitive prior conversations or configuration details beyond what the user explicitly requested in the current task.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Across this section, the skill repeatedly instructs the agent to inspect and use real usage records, system configuration, and historical conversations as source material for content creation. In a content-operations role, this is especially risky because the end product is intended for external publication, so sensitive operational details, private user data, or internal configurations could be unintentionally disclosed or paraphrased into public-facing materials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The table specifies Twitter/X content as 300字左右(英文), which forces a specific language. Under the policy, language constraints should either be optional, user-selected, or clearly justified as region-specific; none of that is provided here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The collaboration guidance directly tells the skill to review the user's historical conversations as part of normal writing workflow, again without warning the user or constraining what may be accessed. This is dangerous because it normalizes broad access to prior chat data and increases the chance of sensitive information being exposed, reused, or inferred in outward-facing content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file defines mandatory reply formats and a fixed onboarding declaration entirely in Chinese, including exact phrases to use in every response. This constitutes a language policy constraint without offering the user a choice or documenting a justified locale-specific limitation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L142-L145 explicitly prohibit the role from performing any file read/write operations itself and require such work to be delegated to an administrative assistant. But L059, L077-L079, and L132-L135 direct the role to use exec ls/grep/wc/sed itself for file existence checks, scanning, counting, and batch path replacement, and L150 even lists grep/ls directory traversal as scenarios for delegation. These instructions actively conflict about who performs the file operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The output specification hard-codes Chinese responses for start, pass, and fail states, and the declaration section repeats a fixed Chinese phrase. This is a natural-language locale policy constraint with no opt-in, alternative language option, or stated regional justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This is a markdown file, so SQP-2 applies to descriptions that omit warnings about behaviours affecting privacy or system integrity. The PRD states the product will connect to real external data sources and includes request throttling to avoid IP blocking, but it does not warn users that network requests, third-party data access, or related data transmission may occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Bug log template explicitly asks users to paste complete error stacks, environment details, and absolute screenshot/log paths, but it provides no guidance to redact secrets, tokens, personal data, internal hostnames, or filesystem details. In practice, this can cause sensitive data to be copied into shared markdown logs, increasing the risk of credential leakage, privacy exposure, and lateral reconnaissance if those logs are broadly accessible or later archived.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.