Agent Teams Simplify And Harden

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:54 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent multi-agent coding workflow, but it asks implementation agents to run with permission checks bypassed and documents an unpinned third-party install command.

Review this skill before installing in a sensitive workspace. Prefer a pinned or vendored installation source, run it only in an isolated repository without unrelated credentials or private files, and remove or avoid the bypassPermissions mode unless you intentionally want implementation agents to act without normal approval prompts.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

bash

npx skills add pskoett/pskoett-ai-skills/agent-teams-simplify-and-harden

Technical Analysis

The installation command invokes an npm-resolved CLI and installs a skill from a third-party repository without pinning either resource to a verified version or immutable commit. Consequently, the content installed when this command is run can differ from the content reviewed during this audit.

This creates a time-of-review versus time-of-installation trust gap. Compromise of the npm package, publisher account, source repository, or referenced branch could cause users to receive modified instructions or executable components. The audited file does not demonstrate that such a compromise has occurred; the vulnerability is the unsafe reliance on mutable upstream resources.

Attack Path

1. An attacker compromises the npm CLI package, its publisher account, the upstream skill repository, or another relevant distribution component.
2. The attacker publishes malicious content under the same mutable package or repository reference.
3. A user follows the documented npx skills add command.
4. The command resolves and downloads the attacker-controlled version rather than a previously audited version.
5. The malicious skill content executes or influences an agent with the privileges available in the installation or subsequent skill-use context.

Impact Assessment

The attainable privileges depend on the environment in which installation and later skill execution occur. A compromised dependency could influence agent instructions, access files available to the agent, initiate permitted tool operations, or execute code with the invoking user's privileges. The scope may include the target repository and any additional resources exposed to the CLI ...[truncated 21 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills CLI to a reviewed, exact version rather than relying on dynamic npm resolution.
• Pin the third-party skill to an immutable commit hash or cryptographically verified release.
• Publish and verify checksums or signatures for all installed artifacts.
• Review the resolved package and skill contents before activation.
• Use a lockfile and trusted internal registry or mirror where supported.
• Run installation and initial validation in a restricted sandbox without credentials or access to unrelated files.
• Establish a controlled update process that requires security review before changing pinned versions.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:94

Finding

Implementation Agents Are Launched with Permission Controls Bypassed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:94-102
Vulnerability Type: Excessive agent privileges and permission-control bypass
Risk Level: High

Complete Code Snippet:

yaml

Task tool (spawn teammate):
  subagent_type: general-purpose
  team_name: "<project>-harden"
  name: "impl-<area>"
  mode: bypassPermissions
  prompt: |
    You are an implementation agent on the <project>-harden team.
    Your name is impl-<area>.

Technical Analysis

The workflow explicitly directs the team lead to start general-purpose implementation agents using mode: bypassPermissions. These agents require repository-scoped read and write capabilities, plus controlled access to build and test commands, but bypassing permission checks grants authority beyond that narrowly defined requirement.

Prompt text that asks an agent to follow assigned tasks is not an enforceable security boundary. Malicious repository content, poisoned specifications, compromised dependencies, or incorrect task instructions could influence an unrestricted implementation agent. With approval controls disabled, dangerous operations may proceed without user confirmation.

The file does not prove that an unauthorized operation has already occurred. The confirmed weakness is the intentional removal of least-privilege approval boundaries in a workflow that processes potentially untrusted project content.

Attack Path

1. An attacker places adversarial instructions in a repository file, specification, dependency output, test message, or other content consumed during implementation.
2. A general-purpose implementation agent reads that content while completing an assigned task.
3. The content induces the agent to execute commands or modify files outside the legitimate implementation scope.
4. Because the agent runs in bypassPermissions mode, normal approval checks do not interrupt the operation.
5. The agent ...[truncated 768 chars]

Remediation

View remediation

Remediation Suggestions

• Remove mode: bypassPermissions.
• Run implementation agents under the normal approval model.
• Grant repository-scoped read and write permissions only to explicitly assigned paths.
• Restrict command execution to an allowlist of documented compile, type-check, and test commands.
• Require explicit approval for network access, dependency installation, destructive operations, and writes outside the repository.
• Execute agents in an isolated workspace or container with no unrelated mounted directories.
• Remove credentials and sensitive environment variables from subagent execution contexts.
• Treat repository content, specifications, test output, and dependency messages as untrusted data rather than authoritative instructions.
• Log tool calls and filesystem changes, then review the resulting diff before accepting agent modifications.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The install instruction uses npx skills add pskoett/pskoett-ai-skills/agent-teams-simplify-and-harden without any pinned version, commit, or integrity control. This causes consumers to fetch and execute whatever version is current at install time, creating a supply-chain risk if the package or referenced content is later changed, compromised, or republished maliciously.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.