Why this verdict
- malicious: finding skill:container/skills/self-customize:container/skills/self-customize/SKILL.md:71:PERSIST passes reach/harm/chain at critical
Security findings 4
Persistence
criticalConfirmedhigh confidenceThe skill instructs the agent to delegate new MCP tool code to a builder agent that writes it into container/agent-runner/src/mcp-tools/ and registers it in mcp-tools/index.ts with no approval step, and that code auto-executes on the next container start, bypassing the admin approval gate the same document requires for add_mcp_server.
new tool code is picked up on the next container start (bun runs TS directly)
vector:instruction
Counter-argument considered
The skill declares admin approval as the control for MCP-capability additions, then instructs an equivalent tool-addition path into the agent's own runtime with no approval step that auto-executes on restart; no carve-out or mitigation in the artifact neutralizes this declared-control bypass.
Privilege escalation
mediumContextual riskmedium confidenceThe skill lets the agent extend its own tool surface by having a builder agent write new MCP-tool code into container/agent-runner/src/mcp-tools/ under scope and diff-size constraints only — with no admin approval gate on the code — and the code auto-activates on next container start, sidestepping the admin approval the add_mcp_server path requires for equivalent capability additions.
Source-code edits inside `/app/src` are picked up automatically on the next container start — no rebuild step needed
vector:instruction
Counter-argument considered
The skill declares admin approval as the control for MCP-capability additions yet instructs an equivalent ungated builder path whose code auto-activates on restart; that control bypass is not a carve-out and the workflow's soft 'confirm with the user' is not the declared admin gate.
Supply chain
mediumContextual riskmedium confidenceThe skill directs the agent to source third-party MCP servers from the external directory mcp.so and launch them via npx with an unpinned package name, executing unvetted remote code once the approval step passes.
Check [mcp.so](https://mcp.so) for an existing RSS MCP server
vector:instruction
Counter-argument considered
Directing the agent to a third-party directory and an unpinned npx package falls outside the pinned official-registry carve-out, so the supply risk stands; the sourcing being openly declared (D4) fails only the undeclared gate, and documentation alone never refutes.
Supply chain
mediumContextual riskmedium confidenceThe skill instructs the agent to discover an MCP server on the third-party directory mcp.so and run it via an unpinned npx package through add_mcp_server, executing remotely selected code in the agent's container with admin approval as the only gate.
add_mcp_server({ name: vector:instruction
Counter-argument considered
Running an unpinned package name discovered on mcp.so through add_mcp_server, with admin approval of an opaque name as the only gate, is not a pinned official-registry install and so is not carved out; that the example openly declares this flow fails only the undeclared gate, which does not refute.
Open questions 1
What the analysis could not settle from the code alone.
Detector leads (PY-CLAIM-CONTRADICTION / PY-CLAIM-RESIDUE) assert an undeclared direct file_write capability at SKILL.md lines 25-26 and 69 that would contradict the 'do not edit directly' delegation instruction, but no such write instruction appears in the surface text shown; does any code view or script of this skill perform direct file writes?
Persistence
Refuted findings 3
Candidates the review stage examined and rejected, kept for transparency.
Persistence
criticalRefutedhigh confidenceThe skill instructs the agent to edit its standing-instruction files memory/ or instructions.prepend.md directly with no approval, persisting behavior changes into every future spawn outside any approval gate.
Edit `memory/` or `instructions.prepend.md` directly, no approval needed
Why it was refuted
Editing memory/ or instructions.prepend.md with no approval is the skill's declared core capability ('modify how you work'), and its no-approval, host-persisted semantics are openly declared in the decision tree, so the flagged behavior is a carve-out and nothing is undeclared.
Persistence
criticalRefutedlow confidenceThe workflow establishes a self-modification path in which the agent delegates source edits to a builder agent and the edited code in /app/src is persisted into the agent's own runtime and executed on the next container start without a rebuild step, relying on the agent's summary review rather than a diff gate.
`/app/src` are picked up automatically on the next container start
Why it was refuted
The auto-pickup of builder edits is itself declared (D3) and part of the skill's declared 'edit code' core capability, and the workflow includes an explicit user-confirmation mitigation the claim omits when it says the gate is only the agent's summary review.
Code execution
criticalRefutedmedium confidenceThe skill instructs the agent to have a builder agent write new MCP tool code into the agent's own source at container/agent-runner/src/mcp-tools/ and register it in mcp-tools/index.ts, where the code is automatically loaded and executed by bun on the next container start.
new tool code is picked up on the next container start (bun runs TS directly)
Why it was refuted
As stated, this finding describes the skill's declared core capability — adding a capability by editing its own code — with the bun auto-execution expressly declared (D3); the exec mechanism is carved-out declared behavior, unlike the approval-gate bypass flagged separately in F7.
Coverage gaps 2
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
.claude/skills/add-clidash/add/tools/clidash/public/favicon.ico
context:unanalyzable_binary binary content is only byte-scanned
src/drivers/docker-driver.ts
