Security audit

Workflow Runner

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with its workflow-automation purpose, but it gives a local agent broad write, commit, persistence, and code-execution behavior without enough containment or user control.

Review before installing. Use this only in repositories where local commits, result files, persistent workflow state, and execution of generated test artifacts are acceptable. Do not feed it untrusted archives or workflow IDs, and prefer running it in a disposable sandbox or container with limited filesystem and credential access.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/testing_worker.sh:4
Finding: Untrusted archive extraction followed by execution of archive-controlled code
Content: View full analysis
&1 || true) ``` ### Technical Analysis The testing worker accepts an archive path from the caller, extracts the archive without validating its origin or contents, and then directly executes `code/scripts/hello.sh` from the extracted files. There is no integrity or provenance verification to establish that the archive was produced by the trusted coding worker. Archive members are not checked for absolute paths, parent-directory traversal components, symbolic links, hard links, device files, or unexpected executable content. The direct execution step makes arbitrary command execution straightforward: an attacker only needs to package a malicious file at `code/scripts/hello.sh`. Archive traversal or link-based entries could additionally affect files outside the intended working directory, depending on the behavior and protections of the installed `tar` implementation. The `|| true` construct suppresses the malicious script's failure status. It does not prevent execution and can make failures less visible to the surrounding workflow. ### Attack Path 1. An attacker creates a gzip-compressed tar archive containing an executable `code/scripts/hello.sh`. 2. The malicious script contains commands chosen by the attacker. 3. The attacker invokes `testing_worker.sh` or influences its caller so that the crafted archive is supplied as `ARTIFACT_PATH`. 4. The worker extracts the archive into its working directory. 5. The worker runs `./code/scripts/hello.sh`. 6. The payload exec ...[truncated 921 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/coding_worker.sh:4
Finding: Unvalidated workflow identifiers allow path traversal and uncontrolled filesystem operations
Content: View full analysis
code/scripts/hello.sh <<'EOF' #!/bin/bash echo "hello world" EOF chmod +x code/scripts/hello.sh # produce patch (simple tarball as artifact) tar -czf ../${WF_ID}-coding-artifact.tgz code cat > ../${WF_ID}-coding-report.json < ../${WF_ID}-test-report.json <"; exit 1; fi mkdir -p "$RESULTS_DIR/$WFID" # collect any logs matching wf id cp -v results/${WFID}.json "$RESULTS_DIR/$WFID/" 2>/dev/null || true ``` ### Technical Analysis The scripts use caller-controlled workflow identifiers directly in directory names and output paths. They do not restrict the identifiers to a safe character set, canonicalize the resulting paths, or verify that resolved paths remain beneath an approved root. An identifier containing `/` or `..` can alter path resolution. In the coding and testing workers, output expressions such as `../${WF_ID}-coding-report.json` and `../$ ...[truncated 2002 chars]
Remediation: View remediation
&2; exit 1 ;; esac ``` 3. Apply a reasonable maximum identifier length. 4. Quote every variable expansion used as a shell argument or path: ```bash tar -czf "../${WF_ID}-coding-artifact.tgz" code cp -v "results/${WFID}.json" "$RESULTS_DIR/$WFID/" ``` 5. Canonicalize each destination and verify that it remains beneath the intended root before reading or writing it. 6. Create temporary directories atomically: ```bash WORKDIR="$(mktemp -d "/tmp/workflow-${WF_ID}-coding.XXXXXX")" chmod 700 "$WORKDIR" ``` 7. Install cleanup traps to remove temporary directories after use. 8. Do not construct JSON through variable interpolation in a here-document. Use a JSON encoder such as `jq` or a language JSON API. 9. Avoid suppressing reporter errors with `|| true`; report missing or ambiguous input files explicitly. 10. Run workers with minimal filesystem permissions so that a path-validation failure cannot affect unrelated data. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: session-store.json:2
Finding: Persistent session identifiers are distributed in plaintext without TTL enforcement
Content: View full analysis
load(), get: (k) => load()[k], set: (k, v) => { const s = load(); s[k]=v; save(s); }, del: (k) => { const s = load(); delete s[k]; save(s); } }; ``` ### Technical Analysis The project distributes persistent subagent and run identifiers in a plaintext JSON file. The storage implementation writes arbitrary state using default filesystem permissions and provides no filtering of values that may contain sensitive session metadata. Although the stored records include `ttl_days`, neither `load()` nor `get()` checks whether a record has expired. No cleanup operation removes stale entries. The bundled `created_at` values are malformed because their seconds fields are missing, preventing reliable standards-compliant timestamp parsing. The documented 24-hour session lifetime is therefore only descriptive and is not en ...[truncated 2082 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises automatic local git commits and writing artifacts to ./results/ without a prominent user warning or explicit confirmation step. Even though the actions are local-only, they modify the user's repository state and filesystem, which can create unintended commits, leak sensitive data into artifacts, or interfere with ongoing work when the skill is invoked casually.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code performs persistent file writes and deletions to session-store.json via writeFileSync, but there is no confirmation prompt, logging, or explanatory comment describing that user/workflow session data will be stored on disk and removed on delete. For a code file, silent persistence and deletion of session data matches the missing-warning criterion for file write/delete operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script extracts an attacker-controlled tarball into a temporary working directory without validating archive contents. Malicious archives can use path traversal, symlinks, or dangerous file attributes to overwrite files outside the intended directory or plant executable content that is later run by the script.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script executes ./code/scripts/hello.sh from the extracted artifact, meaning untrusted archive contents directly control code execution. In the context of a testing worker, this is especially dangerous because the artifact is an input and the script turns that input into shell execution without isolation, enabling arbitrary command execution on the host.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.