Security audit

Laizy

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate coding-run orchestrator, but it relies on an unpinned external CLI and tells agents to run CLI-generated commands with too little validation or user control.

Review this skill carefully before installing. Use it only in an isolated repository or disposable environment, pin and audit the Laizy CLI before installation, inspect every generated verification command before running it, avoid exposing unrelated secrets or credentials, archive run artifacts instead of deleting them, and do not allow automatic commits or pushes unless that workflow is explicitly intended.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:5
Finding: Mutable GitHub Dependency Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation
" ``` 2. Prefer a trusted package registry release with an exact version rather than a range, provided that the published artifact can be independently verified. 3. Record and verify a cryptographic integrity digest for the resolved package or installation artifact. 4. Audit the pinned CLI source, package manifest, dependency tree, and installation lifecycle scripts. 5. Use a lockfile or equivalent reproducible dependency manifest where the host platform supports one. 6. Configure automated monitoring for upstream ownership changes, force-pushes, compromised releases, and dependency advisories. 7. Run installation and the CLI with least privilege in an isolated environment without unnecessary credentials or access to unrelated files. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/decision-map.md:64
Finding: CLI-Generated Verification Commands Are Executed Without Validation or Approval Controls
Content: View full analysis
.verification-command.json` Do: - run the emitted command - record the result before completion ``` `SKILL.md:17-20`: ```md 2. Bootstrap the run once with `laizy start-run`. 3. Use `laizy supervisor-tick` as the source of truth for every later decision. 4. Read the emitted bundle and follow the bounded next action instead of improvising the next step in chat. ``` `SKILL.md:42-45`: ```md - `verify` - Run the emitted verification command. - Record the result before marking a milestone complete. ``` ### Technical Analysis The skill instructs the agent to treat output from `laizy supervisor-tick` as the source of truth and directly execute a command obtained from a generated JSON artifact. It does not require the agent to: - Validate the artifact's provenance or integrity - Confirm that the command matches the current repository and milestone - Parse the command as a structured executable and argument list - Reject shell metacharacters, substitutions, redirections, or chained commands - Restrict executable names, paths, working directories, or environment variables - Display the command and obtain user approval - Use a sandbox with restricted filesystem and network access The command therefore crosses from mutable run-state data into a code-execution sink without an explicit validation boundary. A compromised CLI can generate a malicious verification command directly. In addition, if another process or user can modify files under `state/runs/`, the generated artifact may be replaced before it is consumed. The project does not include the CLI implementation or th ...[truncated 1919 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The guidance recommends archiving or removing prior run artifacts to avoid stale state, but it does not explicitly warn that deletion may destroy logs, snapshots, or recovery context needed for auditability or rollback. In an orchestration skill that manages iterative software delivery, users may follow the instruction mechanically and remove files they later need, causing avoidable data loss or reduced traceability.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.