T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:518- Finding
Unrestricted Execution of Repository-Controlled Shell Commands
- Content
View full analysis
- Remediation
View remediation
Security audit
Autoimprove
Security checks for vulnerabilities and agentic risk
Overview
This autonomous optimization skill is open about running commands and changing repositories, but its headless mode, credential exposure, and destructive rollback behavior need careful review before use.
Install only if you are comfortable with an agent that can edit project files, run project-supplied shell commands, create commits, and reset repository history. Use it first in an isolated clone, container, or disposable worktree with no secrets in the environment, no production kubeconfig or database credentials, and a reviewed improve.md. Avoid headless overnight runs until you have verified the exact scope, commands, backup branch, and recovery process.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/protocol.md:42- Finding
Unsafe Destructive Git Rollback Using Unconditional Hard Reset
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
docs/index.html:634- Finding
Remote JavaScript Dependencies Loaded Without Subresource Integrity
- Content
View full analysis
``` The scripts are subsequently trusted by local initialization code in `docs/index.html:636-648`: ```html ``` ### Technical Analysis The documentation page loads executable JavaScript from a third-party CDN. The package version is pinned, which limits ordinary version drift, but the script elements do not specify Subresource Integrity hashes. The page also lacks an observed Content Security Policy that restricts script execution. Consequently, the browser trusts whatever content the CDN returns for those URLs at viewing time. The effective JavaScript payload can therefore differ from the content reviewed in this project if the CDN, package publication, account, delivery path, or upstream asset is compromised. This differs from a static hyperlink: the remote responses execute automatically in the browser when the documentation page is opened. ### Attack Path 1. An attacker compromises the relevant CDN delivery path, package publication account, upstream release asset, or another component capable of changing the response. 2. Malicious JavaScript is served from one of the referenced URLs. 3. A user opens `docs/index.html` while network access is available. 4. The browser downloads and executes the modified script because no integrity hash verifies its expected contents. 5. The script executes in the docume ...[truncated 766 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (25)
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The README explicitly recommends headless execution with powerful tool permissions: bash, read, write, and edit. In the context of an autonomous optimization loop that can modify files, run commands, and iterate unattended, this creates a high-risk pathway for uncontrolled code execution, repository tampering, secrets exposure, or persistence of harmful changes if the agent behaves unexpectedly or the project contents are adversarial.
- Content
/autoimprove
Headless (overnight)
claude -p "run /autoimprove on improve.md" --allowedTools bash,read,write,edit
text ## The `improve.md` format
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md 2. **Goal-aware threat modeling**: The optimization goal predicts what the agent will try, which predicts what it will break. Generate tests that guard against the failure modes of THAT specific goal: **When goal = faster (lower latency, fewer allocations):** The agent will skip work, take shortcuts, and remove safety checks. - Unicode/multibyte input still works (fast paths assume ASCII) - Empty, nil, zero-length inputs don't crash (nil checks removed for speed) - Error messages are still correct and informative (error formatting skipped)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
The workflow performs 'git reset --hard HEAD~1' automatically after failed experiments. Although intended for rollback, hard reset is a destructive operation; combined with a skill that auto-commits and runs in loops, a mistake in repository state handling, wrong working directory, or weak guardrails can irreversibly discard local work or amplify operational damage.
- Content
md 4. Run the test command (if Check.test is specified) 5. IF tests fail: → git reset --hard HEAD~1 → Log as "test_failed" → consecutive_failures += 1 → Print: "✗ Experiment {id}: {title} — tests failed"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
This is another automatic 'git reset --hard HEAD~1' path triggered on guard failures. The repetition across multiple branches increases the chance of destructive rollback being exercised frequently during unattended runs, making accidental data loss or incorrect repository rollback more likely.
- Content
md 7.5. Check guard metrics (if Check.guard is specified): → Extract guard metric value from stdout → IF guard threshold violated (e.g., error_rate > 0.05): → git reset --hard HEAD~1 → Log as "guard_failed" → consecutive_failures += 1 → Print: "✗ Experiment {id}: {title} — guard violated: {guard_name} = {value}"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
This rollback path hard-resets the repository when the score command errors or times out. Since the score command itself is arbitrary and domain-specific, errors may happen often; coupling arbitrary command execution with destructive history rewriting creates a substantial safety risk in autonomous mode.
- Content
md 8. DECIDE: IF score command failed (non-zero exit, timeout): → git reset --hard HEAD~1 → Log as "error" → consecutive_failures += 1
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
The default non-improvement path also executes 'git reset --hard HEAD~1', making destructive rollback part of normal operation rather than an exceptional path. In the broader skill context, where scope enforcement is only policy and commands are arbitrary, this elevates the danger because unattended experimentation can repeatedly mutate and then forcibly rewrite state.
- Content
md → Print: "≈ Experiment {id}: {title} — {score} (kept, equal score)" ELSE: → git reset --hard HEAD~1 → Log as "discarded" → consecutive_failures += 1 → Print: "✗ Experiment {id}: {title} — {score} (no improvement)"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill explicitly states it runs arbitrary shell commands from improve.md and inherits ambient credentials such as AWS keys, DB credentials, kubeconfigs, and API tokens. Even though this is framed as a warning, it confirms the design permits command execution in a credential-rich environment, which can expose secrets or allow privileged actions if improve.md is malicious, mistaken, or compromised.
- Content
md **Runtime requirements**: git is required. The check commands in your improve.md determine what else is needed (go, python, npm, docker, kubectl, psql, etc.). Verify these are installed before starting. **Credentials**: The agent runs arbitrary shell commands from your improve.md. It inherits whatever credentials are available to the process (AWS keys, DB creds, kubeconfigs, API tokens). Run autoimprove with least-privilege credentials. Strip environment variables you don't want the agent to access. **First run**: Always interactive. The readiness check (Step 1) confirms scope, reviews generated tests, and establishes a baseline before the loop starts. Don't run headless until you've verified one interactive run works correctly.
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <div class="reveal"> <div class="slides"> <!-- TITLE --> <section class="title-slide" data-background="#000"> <h1>From <span class="red">autoresearch</span><br>to <span class="red">autoimprove</span></h1> <p class="subtitle">Generalizing the agentic experiment loop</p>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <p><span class="inline-code">exclude</span> prevents the agent from grading its own homework.</p> </section> <!-- THREE-LAYER CHECK --> <section data-background="#000"> <h2>Three-layer check</h2> <div class="red-bar"></div>
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 70% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
html <tr><th>Goal</th><th>Agent will try to...</th><th>Tests guard against...</th></tr> </thead> <tbody> <tr><td>Faster</td><td>Skip work, remove checks</td><td>Edge cases, unicode, nil, concurrency</td></tr> <tr><td>Smaller</td><td>Remove things, swap deps</td><td>Features still work, runtime deps present</td></tr> <tr><td>More accurate</td><td>Overfit, leak data</td><td>Data leakage, reproducibility, valid outputs</td></tr> <tr><td>Better RAG</td><td>Game retrieval, stuff context</td><td>Format consistency, hallucination, empty results</td></tr>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html query expansion, chain-of-thought generation.</code></pre> </section> <!-- EXAMPLE: AUTOML --> <section data-background="#000"> <h2>Example: tabular ML</h2> <div class="red-bar"></div>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </table> </section> <!-- REAL WORLD: ROUND 2 --> <section data-background="#000"> <h2>Real-world test: round 2</h2> <div class="red-bar"></div>
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
html <div class="red-bar"></div> <p>The skill runs in Claude Code. The protocol runs anywhere.</p> <pre><code class="language-bash">/autoimprove # Claude Code (interactive) claude -p "run /autoimprove on improve.md" # headless overnight /autoimprove --export # generates program.md codex -p "follow program.md" # any agent can follow it gemini -p "follow program.md"</code></pre>
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section authorizes destructive repository operations such as repeated commits and hard resets during an autonomous loop, but provides no mandatory user warning, backup, or checkpointing beyond git history assumptions. That is risky because repositories may contain untracked work, nested repos, or unexpected states, and
git reset --hardcan irreversibly discard local changes.- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The protocol directly instructs use of
git reset --hard HEAD~1after test failures, which is a destructive command that can wipe local modifications in the working tree. In an autonomous agent context, this is especially dangerous because the command is triggered programmatically and repeatedly, increasing the chance of unintended data loss.- Content
md 3. **Commit**: `git add <changed files> && git commit -m "autoimprove: <short description>"`. Verify HEAD changed by comparing `git rev-parse HEAD` before and after. If HEAD didn't change, the commit failed — stop and report. 4. **Test**: If `Check.test` is specified, run it. If tests fail: `git reset --hard HEAD~1`, log as "test_failed", continue to next iteration. 5. **Evaluate**: Run the score command (`Check.run`). If it times out, kill it and treat as failure.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This instance again mandates
git reset --hard HEAD~1on guard failures, coupling an evaluation condition directly to a destructive repository reset. If guard extraction or evaluation logic is wrong, the agent could discard valid work automatically, causing silent loss of changes.- Content
md 6. **Score**: Extract the score from stdout using the extraction method in `Check.score`. 7. **Guard**: If `Check.guard` is specified, extract the guard metric and check the threshold. If violated: `git reset --hard HEAD~1`, log as "guard_failed", continue. 8. **Decide**: - If the score command failed (non-zero exit or timeout): `git reset --hard HEAD~1`, log as "error"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The protocol uses
git reset --hard HEAD~1when score execution fails or times out, meaning transient command failures can trigger destructive rollback. BecauseCheck.runis derived from repository-controlled configuration, malformed or adversarial commands could induce repeated hard resets and data loss.- Content
md 7. **Guard**: If `Check.guard` is specified, extract the guard metric and check the threshold. If violated: `git reset --hard HEAD~1`, log as "guard_failed", continue. 8. **Decide**: - If the score command failed (non-zero exit or timeout): `git reset --hard HEAD~1`, log as "error" - If the score improved: keep the commit, update the baseline, log as "kept" - If the score is equal AND `keep_if_equal` is true: keep the commit, log as "kept_equal" - If the score did not improve: `git reset --hard HEAD~1`, log as "discarded"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This rollback on non-improving scores again relies on
git reset --hard HEAD~1, causing destructive cleanup for normal optimization outcomes. In the context of an autonomous optimizer that iterates many times, repeated hard resets materially increase the risk of losing unrelated local work or leaving the repository in an unexpected state.- Content
- If the score command failed (non-zero exit or timeout):
git reset --hard HEAD~1, log as "error"- If the score improved: keep the commit, update the baseline, log as "kept"
- If the score is equal AND
keep_if_equalis true: keep the commit, log as "kept_equal" - If the score did not improve:
git reset --hard HEAD~1, log as "discarded"
- Log: Save experiment JSON to
.autoimprove/experiments/NNN-slug.jsonwith this schema:json
- If the score command failed (non-zero exit or timeout):
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README says 'One command' and 'just run
/autoimprovein your project,' while also stating users 'don't need to know which sub-commands exist.' For a markdown skill description, this does not clearly bound when the skill should activate versus when it should not, and it lacks negative examples or narrower trigger scope.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill advertises activation on very broad phrases like 'optimize this', 'improve performance', and 'make this faster', which are common benign requests and can cause the autonomous loop to trigger in contexts the user did not intend. Because this skill executes arbitrary commands from improve.md and can make repeated code changes, accidental invocation materially increases the chance of unsafe repository modification or command execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The 'When to Use' guidance includes ambiguous conditions like 'User wants to optimize something measurable' and 'User says optimize/improve/make faster,' which are too general for a high-autonomy skill. In this context, vague activation criteria are dangerous because the skill can scaffold files, run shell commands, and enter a self-directed optimization loop with limited technical enforcement.
- Content
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
html <tr><td>Faster</td><td>Skip work, remove checks</td><td>Edge cases, unicode, nil, concurrency</td></tr> <tr><td>Smaller</td><td>Remove things, swap deps</td><td>Features still work, runtime deps present</td></tr> <tr><td>More accurate</td><td>Overfit, leak data</td><td>Data leakage, reproducibility, valid outputs</td></tr> <tr><td>Better RAG</td><td>Game retrieval, stuff context</td><td>Format consistency, hallucination, empty results</td></tr> <tr><td>Lower cost</td><td>Downsize, cut redundancy</td><td>Load handling, failover, durability</td></tr> </tbody> </table>
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Kubernetes example explicitly runs
kubectl apply -f k8s/, which can modify whatever cluster the current kubeconfig points to. In an autonomous optimization skill, that is more dangerous than a normal doc example because users may copy it into unattended loops and accidentally mutate a live cluster without confirmation, environment gating, or warnings.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The protocol explicitly instructs an autonomous agent to modify files, run commands, and continue without asking for human input. In a skill designed to operate on arbitrary repositories, this is dangerous because it enables unattended changes and execution with no explicit confirmation, safety interlocks, or disclosure of repository impact.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The Docker example runs
docker build -t test ., which executes instructions from the local Dockerfile and build context. That can run arbitrary build steps, consume resources, access networked package sources, or expose host-linked secrets available during builds, and the example provides no warning about that risk.- Content