Multi-Agent Safe-Cooperation (Single Device)

• Outcome: Review
• Latest audit: Aug 18, 2026 · 3:24 AM UTC
• Version: 1.1.0

Overview

This prompt-only skill is not overtly malicious, but it teaches agents to use sensitive local execution, credentials, persistence, and external-action workflows without enough scoping or confirmation.

Review this carefully before installing. Use it only with an MGC setup where tool calls, script execution, credential retrieval, publishing, notifications, and local file writes require explicit user approval. Do not expose the MGC token to sub-agents, and avoid storing sensitive outputs or user-history logs unless you have a clear retention and cleanup process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly tells agents that if MCP is unavailable they may call the FastAPI service directly, which bypasses the narrower tool-mediated interaction model the rest of the skill claims to enforce. In this context, direct API access to sensitive execution endpoints expands agent capability and weakens any safety assumptions based on prompt-constrained roles such as 'Executor Agent only calls mgc_run'.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The FAQ normalizes direct use of the sensitive `/api/mgc/sensitive/run` endpoint as an alternative operating mode, which materially undermines the skill's 'safe-cooperation' framing. Advertising a raw sensitive execution endpoint gives downstream agents or users a path to bypass higher-level guardrails and can enable unauthorized script execution if combined with local token access.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The prompt makes contradictory trust-boundary claims: it says `mgc_run` returns only pid/status and that the Executor handles only desensitized results, but elsewhere instructs the Executor to 'receive sales data' and pass it onward. This ambiguity can cause downstream agents or developers to treat substantive script outputs as safe by default, leading to exposure or propagation of sensitive data through the Executor role.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The prompt asserts the Executor never handles sensitive plaintext, yet assigns tasks like preparing blog posts or email content, which may themselves contain confidential or regulated information. This mismatch weakens the zero-touch model by encouraging operators to classify content payloads as non-sensitive without clear criteria, increasing the risk of unauthorized handling or disclosure.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The prompt claims zero-exposure handling through MGC, but then instructs agents to persist execution results to local files and have later agents read them. This creates a side channel outside the sealed MGC boundary where sensitive data, intermediate results, or derived secrets can be exposed to other agents or local processes.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document says sub-agents should not read directly, yet the workflow tells subsequent agents to read local result files. That contradiction undermines the isolation model and can normalize unauthorized access to data produced by sensitive steps.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: Directing the master agent to read and update a local best-practice file introduces persistent state changes and data collection beyond simple task orchestration. Because the file may accumulate operational details, user habits, or prior-task context, it expands the attack surface and can leak or retain information unnecessarily.

Context-Inappropriate Capability

Low

• Confidence: 91% confidence
• Finding: Persistent tracking of user preferences and collaboration logs is not required for secure orchestration and creates unnecessary data retention. Even if intended for convenience, it can accumulate sensitive behavioral or task-history information that may later be exposed, misused, or accessed without user awareness.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The prompt explicitly recommends running scripts locally or writing results to local files, which weakens the claimed 'zero-exposure' model and can persist sensitive outputs outside the protected MGC boundary. Even if intended for usability, this creates avoidable data exposure and retention risk on the host filesystem.

Intent-Code Divergence

Medium

• Confidence: 78% confidence
• Finding: The contradictory guidance about whether stdout is returned can cause agents to mishandle sensitive output, either assuming results are hidden when they are not or failing to capture required audit data safely. Security-relevant ambiguity in execution semantics increases the chance of accidental disclosure or unsafe workflow design.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The prompt instructs generated scripts to read a local auth token from disk and use it to retrieve sensitive credentials over a local HTTP API, effectively teaching arbitrary scripts how to self-access protected secrets. In a multi-agent setting, this materially expands credential access and makes prompt-induced secret retrieval much easier if an agent is subverted or mis-tasked.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The README describes automatic multi-agent task decomposition and execution in a way that implies system actions may occur once a user issues a command, but it does not clearly warn that agents may trigger tool calls and local actions. In an agentic environment, this can normalize unattended execution and reduce user awareness or consent before sensitive operations or browser-launching behavior occur.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The README explicitly states that AI can use mgc_open_webui() to automatically open the local WebUI, but it does not state that this should happen only with explicit user consent. Even though opening a localhost page is lower risk than arbitrary code execution, it is still a side effect on the user's system and can be abused for nuisance actions, confusion, or to steer users into sensitive interfaces unexpectedly.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill publishes the local API auth token path without a strong warning or usage restriction, which increases the chance that agents or users will retrieve or disclose the token. In a skill centered on handling sensitive resources, exposing the authentication material location materially lowers the barrier to abusing the local API, especially when combined with documented direct sensitive endpoint access.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly instructs agents to update best-practices, user preferences, and feedback records after each task, but it does not require informing the user or obtaining consent for this persistent storage. In a multi-agent orchestration skill, silent retention of preferences and task-derived metadata can accumulate sensitive behavioral data and create privacy and compliance risks over time.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill includes operational flows for publishing content and sending marketing notifications, which are external side-effecting actions, but it lacks an upfront safety warning that the skill may perform outbound actions affecting third parties. In agentic systems, failing to clearly disclose and gate such capabilities increases the risk of unintended publication, spam, reputational damage, or unauthorized user-impacting actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The prompt tells the agent to update a persistent file without warning that this records user preferences, task outcomes, and collaboration history. Hidden persistence changes user expectations and can cause inadvertent storage of sensitive or regulated information.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The instruction to use mgc_save persistently stores code in MGC without requiring user awareness or approval. Persisting generated scripts can preserve embedded logic, parameters, endpoints, or unsafe behavior beyond the current task and make later misuse easier.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The instructions normalize writing outputs to local files without any prominent warning that those outputs may contain sensitive business data and persist on disk. This can lead to accidental disclosure through backups, other local users, malware, or later reuse of the files outside the intended workflow.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The prompt provides operational details for reading a local token and fetching secrets but does not pair that capability with strong warnings, access limitations, or user-consent requirements. That makes sensitive-data access appear routine and safe, increasing the risk of overbroad credential use by generated scripts.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The prompt explicitly instructs retention of user preferences and task history in natural language, creating a logging policy without adequate minimization or consent. Such retained records can reveal workflows, business context, or sensitive user patterns over time.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.