Security audit

Triangulate

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a disclosed multi-agent analysis orchestrator, with no evidence of credential theft, exfiltration, or destructive behavior.

Install this if you want explicit multi-agent analysis. Expect it to spawn several sessions, pass task context to those sessions, optionally read other skills' SKILL.md files in sub-skill mode, and create local report or checkpoint files. Avoid using highly sensitive prompts unless you are comfortable with that data appearing in spawned-session context and local checkpoints.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises operational behaviors that include reading SKILL.md files and writing final results, while the metadata declares only session tools and no explicit file permissions. This mismatch can bypass user/operator expectations and weakens least-privilege controls, especially because the workflow explicitly instructs agents to read external skill files and write deliverables.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document claims high-risk templates only provide an analysis framework and perform no actual operations, but elsewhere instructs spawning executors and sub-skills that read SKILL.md and execute tasks. In a high-risk context like crawling, pentesting, or reverse engineering, that contradiction can enable operational behavior under a misleading 'analysis-only' label, increasing the chance of unsafe or unauthorized actions.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The module-level contract promises a single writer model and read-only access via deep-copied snapshots, but the public get() API returns the mutable internal PipelineContext object directly. Any caller can mutate shared state outside write(), bypassing versioning, history, locking discipline, and change notifications, which can cause inconsistent workflow decisions and hard-to-detect state tampering.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The class and method documentation state that all updates must go through write(), but the API design exposes a direct reference to internal state that can be modified by any consumer. This breaks the bus's security and consistency boundary: listeners are not notified, locks are bypassed after the reference escapes, and downstream components may act on silently altered context.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The validator enforces a subtask count limit using the default tier rather than the strategy-derived tier used during DAG construction. This creates inconsistent security and resource-control behavior: a caller may believe a higher tier budget was approved, but validation silently truncates tasks to a lower default cap, which can omit required analysis steps and produce incomplete or misleading execution plans.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: force_transition bypasses all guard checks and, despite the docstring, permits transition to any phase. In a workflow engine that relies on state guards for correctness, this can let callers skip validation, dispatch, or review gates and produce inconsistent or unsafe workflow state.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill states that delivery uses 'write文件' to output final results, but this side effect is not prominently disclosed in the permission metadata or user-facing safety notes. Undisclosed write behavior can lead to unexpected file creation or overwriting, particularly in automated multi-agent flows where users may not realize artifacts will be persisted.

Static analysis

No suspicious patterns detected.