Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent spec-writing skill; the serious scan alerts mainly point to benchmark output examples, not hidden install or runtime behavior.
Installers should treat this as a lightweight coding/spec assistant. Review any generated specs or code before use, especially for privacy-sensitive history summarization or network-facing URL validation, because the included examples show places where stronger security constraints would be needed.
evals/iteration-1/forward-spec-then-code/with_skill/outputs/implementation.go:46Server-Side Request Forgery in Skill-Generated Image URL Validator
evals/iteration-1/forward-spec-then-code/without_skill/outputs/implementation.go:100Server-Side Request Forgery Through Direct and Redirected URL Validation
The declared description is for a developer-assistance skill focused on specification authoring and reverse-spec analysis. The supplied code does not do any spec-related analysis or assistance. Its primary purpose is operational URL processing: deduplication, syntax validation, and live reachability checking over the network. The outbound HTTP requests are a significant undeclared capability and materially different from the declared intent. Therefore, the description does not accurately represent the code's actual behavior.
The declared description is for a development-assistance skill focused on writing or deriving behavioral specs from code. The supplied code does not perform any spec generation, code understanding, intent alignment, or user-facing analysis. Instead, it is an operational utility function for URL deduplication and remote accessibility validation, including outbound network requests, timeout handling, redirects, concurrency control, and logging. That is a materially different primary purpose and includes undeclared network-access capability, so this is a clear mismatch.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| A feature/capability | Feature-level | Complete behavior of "quota management" |
| A system/service | System-level | Overall behavior of "order system" |
Don't ask the user to specify granularity — infer from context. When uncertain, go one level higher than what the user described, then drill down into key parts within the spec.
### Spec Template
The design automatically forwards prior conversation content to a summarization LLM and persists a transformed version of that history without any user-facing notice, consent model, or documented data-handling boundary. That creates privacy and compliance risk because sensitive user content may be reprocessed by another model endpoint and retained in a modified form outside the user's expectations.
The spec is internally inconsistent about storage semantics: one section says the summarized sequence is persisted back to storage, while another says raw message storage is unchanged. This ambiguity can cause implementers to overwrite canonical conversation records with lossy summaries or deploy a design that mishandles audit, recovery, privacy, or legal-retention requirements.
This function performs live outbound HTTP HEAD requests as part of 'validation', which goes beyond passive spec/understanding behavior and can be abused to probe attacker-controlled or internal URLs. In agent or backend contexts, this creates SSRF-like risk, unexpected network side effects, and data leakage through request metadata and logs.
The implementation actively probes remote resources instead of only deduplicating or analyzing inputs, introducing network interaction not implied by the skill's spec-oriented purpose. Because the URLs are attacker-influenced, this can trigger requests to internal services, third-party endpoints, or tracking infrastructure, causing SSRF-style exposure and operational side effects.
The spec explicitly directs the implementation to issue HTTP HEAD requests to user-supplied URLs, which creates server-side request forgery and privacy exposure risk if untrusted input is accepted without restrictions. It also specifies logging invalid or failed URLs, which can disclose sensitive user-provided URLs or internal endpoints into logs; the skill context makes this more dangerous because the spec is likely to be implemented directly by an agent or developer without additional security guardrails.
This markdown file documents behavior that uses request context containing user and session information, refreshes profile info, persists message history, and calls an external LLM service. Under the markdown-specific warning rule, the description should disclose privacy-relevant behavior because it affects user data and external processing.
L21-L30 describe concrete decision logic: branching tool sets by client version and disabling or rewriting tool descriptions via ConfigOverrides. That contradicts L52's claim that the module is "purely responsible for assembling and starting the agent" and contains no business logic.
L07 says the file is the "main entry point" of the AI assistant agent, while L14 says Generate is "the main external entry point." These statements are not merely incomplete; they present conflicting descriptions of what the true entry point is.
Detected: suspicious.prompt_injection_instructions