Security audit

6skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly documentation for PRD planning, but it also recommends an unattended coding-agent loop that disables permission checks and can modify code repeatedly without review.

Install only if you want PRD templates and are prepared to ignore or rewrite the unattended agent-loop guidance. Do not run the documented --dangerously-skip-permissions loop on untrusted repositories or PRDs; use bounded, reviewed agent runs with normal permission prompts and inspect diffs before commits.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/agent-usage.md:8
Finding: Unrestricted Autonomous Agent Loop Disables Permission Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · references/agent-usage.md (reported line 10)May include surrounding context.
Claude Code

bash
while :; do claude --print --dangerously-skip-permissions \ "Read prd.json, find first story where passes=false, implement it, run checks, update passes=true if successful" done

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document explicitly states the skill only edits PRDs, but the described workflows instruct agents to implement stories, run checks, commit changes, manipulate branches, and update repository files. This mismatch can mislead users and downstream safety controls about the true capability and scope of the skill, increasing the chance that broad code modification is performed without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings