Securing Your AI Agent Workflows with SkillSpector

🔴 HIGH: SDI-2

Location: .agent/workflows/mitra-analyst.md:56–72

Confidence: 85%

Message: The workflow automatically executes local bash scripts (load_workflow.sh) when handlers such as *prd, *comp, *save, and *load are triggered. If parameters or scripts can be manipulated, this introduces a direct vector for Remote Code Execution (RCE) on the host.

Remediation: Avoid invoking shell scripts directly from within agent workflows. Implement safer programmatic APIs instead, or ensure strict input sanitization coupled with mandatory user approval before script execution.

🟡 MEDIUM: SDI-2

Location: .agent/workflows/mitra-designer.md:50–75

Confidence: 80%

Message: The workflow triggers shell script execution (load_workflow.sh) directly from menu commands without sandboxing or parameter verification. If the local script environment is compromised or parameters can be manipulated, it could result in Remote Code Execution (RCE).

Remediation: Replace shell script execution with structured API calls or sandboxed tools. Ensure all arguments are validated against a strict whitelist and that the user is explicitly prompted before any script execution.

🔴 HIGH: SDI-2

Location: .gemini/commands/mitra/persona/analyst.toml:50–66

Confidence: 90%

Message: The persona configuration allows the agent to execute host shell scripts directly upon triggering certain menu selections. This is dangerous because it can be abused to run arbitrary commands or execute malicious payloads present within a repository workspace.

Remediation: Avoid direct execution of host shell scripts from prompt/persona configurations. Implement a safe, sandboxed tool execution layer or restrict actions to predefined, safe API functions.

🟡 MEDIUM: SDI-4

Location: mitra/agents/designer/workflows/ui-designer.md:55–56

Confidence: 90%

Message: The hardcoded completion message template instructs the agent to report highly specific fake outcomes, such as delivering exactly 47 components and validating accessibility to WCAG 2.1 AA, regardless of the actual task executed. This forces the agent to generate fabricated or hallucinated status reports, misleading developers or automated workflows that consume these messages.

Remediation: Replace the static values in the completion template with placeholders (e.g., '{number_of_components}') or instruct the agent to generate a summary based dynamically and truthfully on the actual deliverables produced during execution.

🟡 MEDIUM: SQP-1

Location: .agent/skills/workflow-loader/SKILL.md:21–22

Confidence: 80%

Message: The trigger phrase 'What can you do?' is extremely common in typical conversational interactions with LLMs. Binding this specific phrase to the execution of an external shell script can cause frequent, unintended tool invocations, leading to unnecessary resource consumption and potential exposure of directory structure details.

Remediation: Restrict workflow listing to more explicit, developer-centric intents or commands (e.g., 'list workflows' or 'show workflows') rather than hijacking general conversational inquiries.

🔴 HIGH: SQP-2

Location: .agent/workflows/mitra-analyst.md:56–72

Confidence: 90%

Message: The workflow initiates local script execution and external web searches silently in the background without explicit warnings or user confirmations. This risks silent privilege abuse or unintended leakage of sensitive project information to external search APIs.

Remediation: Integrate user-confirmation hooks prior to executing high-privilege operations such as shell scripts and external web requests.

🟡 MEDIUM: SQP-2

Location: .agent/workflows/mitra-architect.md:50–80

Confidence: 85%

Message: The workflow automatically executes shell scripts (`load_workflow.sh`) when menu commands are triggered, without disclosing this action or requesting confirmation from the user. If an adversary compromises the repository files, this can lead to silent arbitrary code execution.

Remediation: Require explicit user confirmation and provide full disclosure before executing any external shell script, or use safe programmatic API calls instead of executing shell scripts directly.

🟡 MEDIUM: SQP-2

Location: .agent/workflows/mitra-designer.md:21–76

Confidence: 85%

Message: The agent creates local directories and executes local shell commands automatically without explicit disclosure or obtaining user permission. This silent behavior violates security policies regarding system state modification.

Remediation: Implement an explicit warning mechanism. Prompt the user for approval before creating target directories or executing command-line scripts.

🟢 LOW: SQP-1

Location: .agent/workflows/mitra-engineer.md:84

Confidence: 70%

Message: The natural-language trigger is overly broad, meaning the report-protocol can be activated accidentally during casual discussion without explicit user intent. This degrades conversational reliability.

Remediation: Modify the trigger to require a specific prefix or keyword command, such as ensuring the protocol is only executed after an explicit command input like '*report'.

🔴 HIGH: SQP-2

Location: .agent/workflows/mitra-engineer.md:15–77

Confidence: 90%

Message: The workflow automatically creates directories and executes local bash scripts with parameters pulled from configuration files. Without validation or user prompts, this could allow arbitrary command injection or directory traversal.

Remediation: Implement user approval prompts before running any shell scripts or writing to disk, and carefully sanitize all config parameters (such as project_id) against an allowlist.

🟡 MEDIUM: SQP-2

Location: .agent/workflows/mitra-manager.md:12–61

Confidence: 80%

Message: The workflow triggers the execution of local shell scripts (`load_workflow.sh`) from within the agent's handler logic without prompting the user for authorization. If workspace files are untrusted or can be modified, this could result in local arbitrary command execution.

Remediation: Replace shell script execution with declarative runtime actions, or require explicit user confirmation and validation before running local scripts.

🟡 MEDIUM: SQP-2

Location: .agent/workflows/mitra-orchestrator.md:77–98

Confidence: 85%

Message: The workflow automatically executes shell scripts via the load_workflow.sh command during state save and load operations without prompting the user for approval. This can allow unauthorized execution of code if scripts or environment parameters in the repository are untrusted.

Remediation: Implement an explicit user confirmation check or alert warning before invoking any local scripts, or use secure application APIs instead of invoking shell scripts.

🟡 MEDIUM: SQP-2

Location: .claude/commands/mitra/analyst.md:50–70

Confidence: 80%

Message: The menu handlers automatically execute local bash scripts and initiate web searches without informing the user or asking for confirmation. In environments with untrusted files, this could allow an attacker to trigger malicious code execution via hijacked local scripts.

Remediation: Modify the menu handlers to prompt the user for confirmation before executing any local shell scripts or external API/web searches, displaying the exact command/action to be performed.

🟡 MEDIUM: SQP-2

Location: .claude/commands/mitra/architect.md:47–66

Confidence: 90%

Message: The agent is instructed to automatically run local shell scripts via the workflow-loader command execution block. This can lead to arbitrary command execution on the user's host machine without proper confirmation or input sanitization.

Remediation: Do not execute local shell scripts directly through agent actions without explicit user confirmation. Instead, prompt the user for permission or display the command to be executed manually.

🟡 MEDIUM: SQP-2

Location: .claude/commands/mitra/designer.md:3

Confidence: 90%

Message: The script instructs the system to execute local bash scripts and perform filesystem modifications automatically. If a repository has been compromised or modified, executing these commands silently without user confirmation can result in arbitrary code execution.

Remediation: Update the command definitions to explicitly prompt the user for confirmation and display the command to be executed before invoking any external script or making changes to the local filesystem.

🟡 MEDIUM: SQP-2

Location: .claude/commands/mitra/engineer.md:45–73

Confidence: 80%

Message: The skill configures the LLM to automatically execute local shell scripts (`load_workflow.sh`) and create directories without warning the user. If an adversary compromises the repository or local files, this could lead to unexpected or unauthorized code execution on the user's system.

Remediation: Add explicit warnings in the command's metadata/description alerting the user that local scripts will be executed and directories will be created. Require explicit user confirmation before executing any shell scripts.

🟡 MEDIUM: SQP-2

Location: .claude/commands/mitra/manager.md:23–57

Confidence: 70%

Message: The configuration instructs the agent to execute shell scripts (.sh) and automatically create directories on the host filesystem without presenting warnings or requiring explicit user confirmation. If this workspace is untrusted, opening it could result in unauthorized script execution on the developer's system.

Remediation: Modify the command workflow to explicitly require user confirmation and display clear warnings before triggering shell scripts or making filesystem modifications.

🟡 MEDIUM: SQP-2

Location: .claude/commands/mitra/orchestrator.md:81–96

Confidence: 85%

Message: The orchestrator executes a local shell script ('load_workflow.sh') dynamically using parameters derived from directories in the workspace. If directory names or configurations are manipulated by an attacker, this could lead to arbitrary shell command execution.

Remediation: Avoid automatic execution of arbitrary local scripts from the model context. Implement a verification prompt or sanitize the paths tightly before execution, ensuring the command executor only accepts safe, hardcoded parameter values.

🟡 MEDIUM: SQP-1

Location: .claude/skills/workflow-loader/SKILL.md:21–22

Confidence: 80%

Message: Using a highly common conversational phrase like 'What can you do?' as a trigger causes the agent to automatically invoke underlying shell scripts during general exploration, leading to unintended tool execution and potential disruption of standard user-agent interactions.

Remediation: Replace the broad trigger phrase with a specific, explicit command, such as 'list available workflows' or a dedicated slash command like '/list-workflows', to prevent accidental execution.

🟡 MEDIUM: SQP-1

Location: .gemini/GEMINI.md:27–28

Confidence: 80%

Message: The system instruction forces the agent to output a specific welcome message and main menu upon broad triggers like 'hi' or 'start'. This can hijack the conversation flow and prevent the system from properly processing the user's actual initial query.

Remediation: Modify the startup protocol to only trigger on explicit commands (e.g., '/mitra:menu') rather than hijacking general conversational greetings like 'hi' or 'start'.

🟡 MEDIUM: SQP-1

Location: .gemini/skills/workflow-loader/SKILL.md:21–22

Confidence: 80%

Message: Using a highly common conversational phrase like 'What can you do?' as a trigger for executing local shell scripts causes the agent to run commands during benign inquiries. This leads to redundant execution and potential exposure of directory structure or workflow names without explicit user consent.

Remediation: Refine the trigger instructions in the SKILL.md to respond to specific commands like 'list workflows' or 'show available workflows' rather than hijacking generic helper prompts.

🟡 MEDIUM: SQP-1

Location: AGENTS.md:59

Confidence: 75%

Message: Using highly common conversational phrases like 'remember this' as mandatory triggers for state-saving workflows creates a risk of accidental execution. This can be triggered inadvertently during normal chat conversations or via indirect prompt injection from processed external documents, leading to state corruption or resource depletion.

Remediation: Replace vague natural language triggers with unique, explicit commands (such as '/save-state' or '*save') and implement a confirmation step before the agent executes the state-persisting workflow.

🟡 MEDIUM: SQP-1

Location: ANTIGRAVITY.md:31–32

Confidence: 80%

Message: Forcing the agent to output the welcome menu on common greetings like 'hi' or 'start' hijacks normal conversational flows. This degrades the user experience by overriding other legitimate initial queries.

Remediation: Modify the startup protocol so it is only triggered by explicit commands like '/mitra:orchestrator' rather than generic greeting phrases.

🟡 MEDIUM: SQP-1

Location: CLAUDE.md:31–32

Confidence: 80%

Message: Forcing the agent to output a specific welcome menu whenever a user types common greetings like 'hi' or 'start' hijacks the conversational interface. This disrupts the normal user experience and can prevent natural interactions or initial queries from being addressed.

Remediation: Modify the startup protocol to trigger only on explicit commands (e.g., `/mitra:start`) or when the conversation begins without any prior user query, rather than hijacking common conversational greetings.

🟡 MEDIUM: SQP-2

Location: README.md:19–149

Confidence: 80%

Message: The documentation describes an autonomous multi-agent system capable of direct codebase implementation and execution, but lacks crucial safety warnings. Running untrusted AI-generated code or giving agents write-access to local repositories without sandboxing exposes users to arbitrary file modification or code execution vulnerabilities.

Remediation: Add a prominent 'Security Guidelines' section in the README.md advising users to run the agents in an isolated sandbox environment (such as Docker or a virtual machine) and to review all proposed changes prior to execution.

🔴 HIGH: SQP-2

Location: mitra/agents/analyst/persona.md:17

Confidence: 80%

Message: The agent persona explicitly allows the agent to write, generate, and execute application code without specifying any safety warnings, sandboxing requirements, or human-in-the-loop approvals. If the agent processes adversarial or untrusted input, it could be manipulated into executing malicious code directly on the host system.

Remediation: Update the persona configuration to explicitly state that all code execution must occur within a secure, isolated sandbox environment. Additionally, implement a mandatory human-in-the-loop approval step before any generated code is executed.

🟡 MEDIUM: SQP-2

Location: mitra/agents/analyst/workflows/memory-manager.md:44–46

Confidence: 85%

Message: The workflow saves rich session state, including user names, decisions, summaries, and artifact details, to local YAML files without any data sanitization or user warning. If users inadvertently input API keys, credentials, or highly sensitive intellectual property during the session, this data is persisted in plaintext locally, which could be leaked if the files are committed to a shared repository or accessed by unauthorized users.

Remediation: Update the workflow instructions to explicitly warn the user before writing files to local storage, and implement an automatic sanitization step that scrubs potential high-risk strings (such as bearer tokens, passwords, or keys) from the payload before saving. Additionally, recommend that users add the memory directory (`artifacts/*/analyst/memory/`) to their project's `.gitignore` file.

🔴 HIGH: SQP-2

Location: mitra/agents/architect/persona.md:17

Confidence: 80%

Confidence: 80%

Message: The persona explicitly enables the agent to write, generate, and execute application code without defining any safety constraints or authorization workflows. If the agent is targeted by a prompt injection attack, it could be coerced into running malicious system commands or arbitrary code on the host machine.

Remediation: Modify the persona definition to explicitly require user approval and authorization before executing any code, or enforce code execution inside a strictly isolated, sandboxed container environment.

🟡 MEDIUM: SQP-2

Location: mitra/agents/designer/persona.md:17

Confidence: 80%

Message: The agent is explicitly granted the capability to write, generate, and execute application code (HTML/CSS/JSX) without any safety constraints, boundary definitions, or sandboxing instructions. This lack of guardrails can lead to insecure code generation, arbitrary code execution, or cross-site scripting (XSS) when the agent processes untrusted inputs.

Remediation: Update the persona to include explicit security guardrails. Instruct the agent to avoid executing untrusted code, enforce strict sandboxing, and mandate human-in-the-loop review before any code is executed or deployed.

🟡 MEDIUM: SQP-2

Location: mitra/agents/designer/workflows/memory-manager.md:44–46

Confidence: 70%

Message: Storing session state in local plaintext files without integrity validation or access restrictions can expose sensitive data (such as user credentials, project identifiers, or intellectual property) to unauthorized local users and permits tampering with session data, potentially leading to state-injection attacks upon restoration.

Remediation: Incorporate explicit security warnings regarding data privacy and state integrity within the workflow specification. Implement cryptographic signatures (e.g., HMAC) to verify state files before loading, and mandate the use of safe YAML parsers to prevent arbitrary code execution during restoration.

🟡 MEDIUM: SQP-2

Location: mitra/agents/engineer/persona.md:17

Confidence: 80%

Message: The persona configuration explicitly enables the agent to execute application code without mentioning user warnings or human-in-the-loop verification. If the agent receives untrusted input, this can result in arbitrary code execution on the underlying host.

Remediation: Add a strict verification step requiring user consent prior to executing any code, and clearly document code execution warnings within the agent's initialization workflows.

🟡 MEDIUM: SQP-2

Location: mitra/agents/engineer/workflows/developer.md:109

Confidence: 75%

Message: The developer agent workflow defines capabilities for executing database migrations and production deployments but lacks any instruction requiring operator confirmation. An autonomous agent executing these high-impact and potentially destructive actions without human-in-the-loop oversight could cause unintended data loss or service disruption.

Remediation: Update the 'Execution Workflow' and 'Data & Storage' sections to explicitly mandate a human-in-the-loop (HITL) confirmation step before running any production migrations, deployments, or destructive schema changes.

🟡 MEDIUM: SQP-2

Location: mitra/agents/engineer/workflows/documenter.md:4–5

Confidence: 80%

Message: The workflow grants the agent powerful filesystem access tools (Read, Write, Edit, Grep) alongside external network tools (WebFetch, WebSearch) without explicit boundaries or user-consent warnings. This combination allows a malicious or compromised agent to read sensitive local codebases, configurations, or API specifications and exfiltrate them via web requests.

Remediation: Implement strict tool-use policies that separate filesystem access from network access. Require user authorization before external-facing tools (WebFetch/WebSearch) are invoked with payloads derived from local project files, or ensure sensitive data is filtered before reaching these tools.

🔴 HIGH: SQP-2

Location: mitra/agents/manager/persona.md:17

Confidence: 80%

Message: Enabling the agent to write, generate, or execute application code without explicit safety warnings, sandboxing, or mandatory human-in-the-loop validation presents a high risk. This could allow the agent to execute malicious or unintended code on the host environment under adversarial influence.

Remediation: Update the agent persona to mandate a sandboxed execution environment and enforce human-in-the-loop approval before executing any code. Explicitly document safety constraints in the agent's system prompt/persona.

🔴 HIGH: SQP-2

Location: mitra/agents/orchestrator/persona.md:17

Confidence: 85%

Message: Enabling agents to write, generate, and execute application code without specifying safety guardrails, sandboxing, or validation rules creates a severe risk of arbitrary code execution. A malicious actor could leverage prompt injection to execute unauthorized actions on the underlying system.

Remediation: Update the orchestration capability to explicitly require code execution to occur within a securely isolated sandbox. Mandate human-in-the-loop (HITL) approval before any generated code is executed on the host system or in production environments.

🟡 MEDIUM: SQP-2

Location: mitra/agents/orchestrator/workflows/memory-manager.md:11–47

Confidence: 80%

Message: The workflow automatically serializes and writes session state data (including summaries and artifact paths) to the filesystem without any data sanitization or filtering. If the session contains sensitive information, credentials, or personally identifiable information (PII), it will be persistently written to unencrypted local files, creating a data exposure risk.

Remediation: Implement a sanitization step to filter out secrets, API keys, and PII from the session data before writing to YAML files. Additionally, add a warning to users about what data is being captured and request confirmation before performing filesystem writes.

🔴 HIGH: P2

Location: .claude/commands/mitra/architect.md:45

Confidence: 80%

Message: The menu handlers dynamically configure the LLM to invoke shell scripts (`load_workflow.sh`) on local directories when triggered, raising risks of unauthorized tool utilization.

Remediation: Ensure command handlers only prepare the configuration or suggest actions, requiring the host application or user to explicitly approve executing any workflow loader scripts.