Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 文档与理论文本 | 本 `SKILL.md`、`README.md`、其中「理论依据」段与一切理论表述 | **不在 MIT 覆盖范围内**：保留所有权利（All rights reserved） |
Security audit
coding-agent
Security checks for vulnerabilities and agentic risk
Overview
The package is not malicious, but it advertises write-capable background coding delegation without enough scope or user-control detail, so it should be reviewed before use.
Install only if you are comfortable with a coding-delegation skill that advertises write-capable tooling but does not define a concrete approval, execution, rollback, or audit process. Treat it as documentation/methodology, and require explicit confirmation before letting it modify code or route work to any background agent.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The front matter advertises allowed tools such as Read, Glob, Grep, Write, and WebSearch, and the license section earlier references code licensing. Later, the same file states there are no independent code files and that the package is purely documentation/theory, creating an active contradiction in the skill's own documentation about whether executable skill behavior exists.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest description says the skill delegates coding work to backend agents like Codex, Claude Code, or OpenCode. However, the document later explicitly says the package has no standalone code files and is a pure documentation/theory artifact, which means the described operational behavior is not actually implemented here.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Overly broad trigger keywords like generic terms for 'coding' and 'agent' can cause this skill to activate in unrelated conversations, increasing the chance that coding-delegation behavior is invoked without clear user intent. In a skill that contemplates handing work to background coding agents, accidental invocation can expand operational scope, cause unintended task routing, and create opportunities for misuse or prompt-surface confusion.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest advertises many broad trigger phrases such as '后台开发', 'PR 审查', and '把编码丢出去跑', which can match common conversational requests without clearly stating boundaries, exclusions, or required user intent. In a delegation skill that can hand coding tasks to external agents, overbroad activation raises the risk of unintended invocation, causing sensitive code review or development workflows to be routed to a background agent when the user did not explicitly consent to that mode.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The file begins with a Chinese-only scope notice that materially affects how the license should be understood, while the rest of the license is in English. This can create a language/locale policy concern because readers are expected to rely on a specific language for important usage conditions without any opt-in or explicit bilingual choice.
- Content