Zero Cover Mode

• Outcome: Review
• Latest audit: Jul 5, 2026 · 8:15 PM UTC
• Version: 1.0.2

Overview

This bug-fixing automation skill has a coherent purpose, but it asks agents to run live code against real project systems and make persistent or destructive local changes without enough guardrails.

Review before installing. Use this only in trusted repositories and preferably in a sandbox or staging environment. Do not let it run against production services, production databases, private customer data, or live credentials unless you have explicitly approved that scope. Disable or manually review cron-style verification and cleanup/compact operations, and keep backups or version control available before allowing generated tests or regression commands to run.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output

Findings (22)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not cov_args:
            cov_args = ["--cov", "."]
        cmd = [sys.executable, "-m", "pytest"] + cov_args + [test_path, "--no-header", "-q"]
        result = subprocess.run(
            cmd,
            capture_output=True, text=True, timeout=30,
        )

• Confidence: 86% confidence
• Finding: The code executes `pytest` against a user-supplied `test_path`, which can trigger arbitrary code execution through test imports, pytest plugins, `conftest.py`, and module-level side effects in the target repository. Although `subprocess.run` is called without `shell=True`, the dangerous behavior is that untrusted project code is intentionally executed during analysis.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes broad operational capabilities including shell execution, file reads/writes, environment inspection, and likely network/backend interaction, but does not declare corresponding permissions in the manifest. This creates a transparency and least-privilege failure: an agent may perform sensitive actions that users or policy layers cannot accurately anticipate or constrain from the metadata alone.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to set up cron-based post-deployment tasks, which introduces persistent system changes beyond one-shot bug fixing and reporting. Persistence increases risk because it can create unattended execution, recurring access to project resources, and hard-to-notice side effects long after the original task completes.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill explicitly directs use of real business data, real backend calls, and inspection of logs or database state during testing. In a generic bug-fix skill, this is dangerous because it can expose sensitive data, mutate production-like systems, and trigger unintended operational effects without clear environment scoping or consent safeguards.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The function dynamically locates and executes a local gateway.py via spec.loader.exec_module(mod), which runs arbitrary top-level Python code during a mere 'availability' check. In an untrusted or user-controlled workspace, an attacker can place a malicious gateway.py that executes code as soon as this checker runs, leading to arbitrary code execution.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The CLI `rotate` branch uses `os.replace` directly and recreates the file, which bypasses the safer `rotate_and_append()` path that explicitly performs backup-aware rotation. This inconsistency can cause unexpected data loss or weaker recovery guarantees if operators assume the documented safe rotation behavior applies everywhere, especially during manual CLI-triggered rotation.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: `verify_integrity()` relies on `state['ndjson_line_count']`, but `sync_state()` never updates that field and only writes `updated_at`. This creates a persistent integrity-check mismatch and can mask or misreport storage consistency problems, weakening operational trust in the persistence layer and potentially interfering with rollback/recovery decisions.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: verify_integrity uses json.loads and json.JSONDecodeError without importing json, so integrity checks and auto-repair can fail at runtime with NameError. In a persistence/recovery component, broken verification can allow corruption to go undetected or prevent recovery logic from running, reducing reliability and potentially enabling denial of service when malformed state is encountered.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The module silently creates a workspace marker file during path discovery, which is a side effect beyond simple state reading. Hidden filesystem mutation increases risk because merely invoking read-like flows can alter repository contents, interfere with tooling, or plant marker files in unintended locations if path detection resolves unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: cleanup_bugs performs recursive deletion of directories under a computed bugs path without strong safeguards such as canonical-root enforcement, symlink checks, or an execution-time confirmation. In an agent skill context, filesystem deletion is materially dangerous because a mistaken workspace root or crafted directory layout can cause destructive removal of unintended local data.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: compact is documented as state/checkpoint compaction but also recursively deletes orphan bug directories. This mismatch is dangerous because a caller may invoke a seemingly safe maintenance operation and unexpectedly lose filesystem data, especially in an automated agent workflow where commands may be executed non-interactively.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The code’s documented behavior contradicts its actual behavior: compact claims to only compress state data yet deletes directories recursively. Security-relevant documentation drift is itself a vulnerability in agentic tooling because operators and higher-level orchestrators may authorize the action under false assumptions, leading to accidental destructive operations.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The class exposes a generic command execution surface via run() and run_custom(), allowing callers to execute arbitrary binaries with caller-controlled arguments, cwd, and environment. In an agent skill context, this is more dangerous because higher-level orchestration may pass repository, issue, or user-derived input into these methods, turning the skill into an arbitrary code execution primitive on the host.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The auto-activation conditions are overly broad, covering implicit bug-fix requests, any failed test, and even generic errors or warnings. This can cause the skill to seize control in situations the user did not clearly authorize, leading to unbounded file modification, test execution, logging, and persistence behaviors triggered by ambiguous context.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill mandates testing against real project data and real backends but does not provide a prominent user-facing warning about privacy exposure, cost, data integrity, or system impact. In context, this is more dangerous because the skill is framed as an automatic closure pipeline, increasing the chance that risky operational testing happens as a default rather than an exception.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill recommends agent-executed cron setup for follow-up verification without a clear warning that this creates persistent system changes. Users may reasonably expect a bug-fix skill to be ephemeral; hidden persistence expands the attack surface and can outlast the original session or user awareness.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The orchestrator writes attacker-controlled test code to the workspace and then invokes a test command via the test runner, which can execute arbitrary code contained in those tests. In a skill that accepts generated or external inputs, this creates a strong code-execution pathway with potentially destructive effects on the host or repository if isolation is absent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: A command that performs recursive deletion without an explicit warning at the point of execution is unsafe, particularly for an agent skill that may be invoked automatically. Users or orchestrators may treat cleanup as low-risk maintenance, but the operation can permanently remove local directories if state or workspace detection is wrong.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: compact deletes orphan directories recursively without clear execution-time warning, despite its non-destructive name and docstring. In an automated skill context this can convert a routine maintenance action into silent data loss, making the risk materially higher than a mere documentation nit.

Unvalidated Output Injection

High

• Category: Output Handling

Content

if not cov_args:
            cov_args = ["--cov", "."]
        cmd = [sys.executable, "-m", "pytest"] + cov_args + [test_path, "--no-header", "-q"]
        result = subprocess.run(
            cmd,
            capture_output=True, text=True, timeout=30,
        )

• Confidence: 81% confidence
• Finding: This active test execution captures output from running untrusted pytest targets; while the main issue is arbitrary code execution from the tested project, captured stdout/stderr can also contain hostile escape sequences or misleading content if surfaced to users or logs. In this skill context, the detector is meant to analyze arbitrary test files, so automatically executing them materially increases danger.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 零稀泥模式 — 开发依赖
# pip install -r requirements-dev.txt

pytest>=7
pytest-cov>=5

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower-bound only constraint (pytest>=7), which allows future major or minor versions to be installed without review. This can introduce supply-chain risk, unexpected breaking changes, or inadvertently pull in a vulnerable release during development and CI.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# pip install -r requirements-dev.txt

pytest>=7
pytest-cov>=5

• Confidence: 92% confidence
• Finding: The dependency pytest-cov>=5 is unpinned, so installs are not reproducible and may resolve to unreviewed future versions. In development tooling this is usually lower risk than production code, but it still increases supply-chain exposure and can destabilize test environments.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: lib/backend_checker.py:84