4skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 1.0.0

Overview

This PRD skill is mostly documentation, but it includes an unattended coding-agent workflow that bypasses permission checks and can repeatedly modify a repository.

Install only if you want PRD documents that can drive coding agents. Do not run the documented unattended loop as written; keep normal permission prompts enabled, review each story and diff, use a bounded workflow, and run any autonomous implementation in an isolated worktree or sandbox without secrets.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/agent-usage.md:10

Finding

Unrestricted Unattended Agent Execution

Content

View full analysis

Vulnerability Details

File Location: references/agent-usage.md, lines 10–13
Vulnerability Type: Unauthorized access and privilege escalation through disabled permission enforcement
Risk Level: High

Vulnerable Code

bash

while :; do
  claude --print --dangerously-skip-permissions \
    "Read prd.json, find first story where passes=false, implement it, run checks, update passes=true if successful"
done

Technical Analysis

The documented command launches an infinite autonomous coding-agent loop with --dangerously-skip-permissions. This option disables the agent's interactive permission safeguards while the agent reads project-controlled prd.json content, edits source files, and runs commands.

This violates least-privilege principles because the Skill's declared purpose is to create and manage PRDs, yet the recommended workflow grants an implementation agent broad, unattended access under the invoking user's account. PRD fields must be treated as untrusted task data rather than trusted executable instructions. A malicious or compromised PRD could contain acceptance criteria or story text crafted to induce unsafe shell commands, access files outside the project, or perform unrelated operations.

The unbounded while : loop compounds the risk by repeatedly invoking the agent without a maximum iteration count. Failed, destructive, or resource-intensive behavior may therefore recur indefinitely.

Attack Path

1. An attacker modifies or contributes a project prd.json, including malicious instructions in a user story, description, acceptance criteria, or notes.
2. A user follows the documented unattended-loop example.
3. Claude Code reads and interprets the attacker-controlled PRD content.
4. The --dangerously-skip-permissions option removes interactive authorization barriers for tool use.
5. The agent may execute attacker-influenced commands or file operations with the invoking user's effective privileges.
6. The infinite ...[truncated 1245 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --dangerously-skip-permissions from all documented commands and retain interactive approval for privileged tool operations.
2. Replace the infinite loop with a bounded workflow that processes one story per invocation or enforces a strict maximum iteration count.
3. Require explicit human approval before:
   • Executing shell commands.
   • Accessing files outside the designated repository or worktree.
   • Using the network.
   • Reading credentials or sensitive configuration.
   • Creating commits or changing branches.
4. Treat all PRD fields as untrusted data. Add agent instructions stating that story content cannot override security constraints, expand filesystem scope, request secrets, or authorize unrelated commands.
5. Validate the PRD against a strict schema and reject unexpected fields or instruction-like content that requests privileged behavior.
6. Run autonomous implementation in an isolated container or restricted worktree with:
   • No mounted credentials or secrets.
   • Minimal filesystem permissions.
   • Restricted or disabled network access.
   • A non-privileged operating-system account.
   • CPU, memory, execution-time, and process limits.
7. Stop on failed checks or unexpected modifications rather than automatically retrying.
8. Present a diff and command log for human review before marking a story complete or persisting repository changes.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document explicitly claims the skill only edits PRDs, but the embedded usage patterns instruct agents to implement code, create branches, run checks, commit changes, and update multiple repository files. That mismatch is dangerous because it can mislead operators or downstream policy systems into granting broader automation than intended, increasing the chance of unauthorized code modification.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The example invokes an external coding agent CLI with --dangerously-skip-permissions, which bypasses normal permission safeguards while feeding it instructions sourced from repository files. In this context, external model/provider execution combined with disabled permission checks materially raises the risk of unreviewed code execution, data exposure, and unauthorized repository modification.

Content

Scanner excerpt · references/agent-usage.md (reported line 10)May include surrounding context.

Claude Code

bash

while :; do
  claude --print --dangerously-skip-permissions \
    "Read prd.json, find first story where passes=false, implement it, run checks, update passes=true if successful"
done

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The unattended loop continuously invokes an agent to implement stories and modify project state without any built-in confirmation, stop guardrails beyond task completion, or user-facing warning about repeated writes. In practice, this can amplify mistakes, allow prompt-injected tasks in PRD/progress files to be executed repeatedly, and cause broad unintended repository changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The prompt template directs the agent to create/check out branches, implement code, commit changes, and write to tracking files, but does not include explicit warnings, approval checkpoints, or restrictions on what may be modified. This encourages silent repository mutations and can turn untrusted PRD/progress content into operational instructions for automated code changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.