Skill

build-from-issue

skill:nvidia/openshell#build-from-issue

Plan and implement work described in a GitHub issue, including verification, documentation, and a PR that closes the issue.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:07 UTC at fa2d381

findings

high

highest severity

threat classes

2,140

files scanned

39/39

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:.agents/skills/build-from-issue:.agents/skills/build-from-issue/SKILL.md:12:HIJACK
suspicious: finding skill:.agents/skills/build-from-issue:.agents/skills/build-from-issue/SKILL.md:28:PERSIST

Security findings 2

Persistence

highContextual riskmedium confidence

The skill instructs the agent to write to agent skill files as part of implementing an issue ('Update relevant skills when behavior or commands change'), an agent control-plane write whose scope is conditioned on the task's own changes and plausibly honest documentation sync via reviewed PR.

.agents/skills/build-from-issue/SKILL.md:28

Update relevant skills when behavior or commands change.

trigger:conditionalvector:instruction

Counter-argument considered

Strongest case against: the write is openly stated, conditioned on real behavior changes, and channeled through a reviewed PR ('Review the diff, use a signed-off Conventional Commit, and prepare the PR'), but open disclosure is not a carve-out, the declared 'documentation' capability is scoped by the skill's own text to published docs rather than agent skills, so the instruction to edit the agent's own governing skill files is an uncovered control-plane write and survives.

Agent hijacking

mediumContextual riskmedium confidence

The build-from-issue skill instructs the agent to adopt workflow rules from files outside the reviewed agent-content surface — Label Discovery, Branch Names, and verification guidance in CONTRIBUTING.md plus the contributor access and issue acceptance check in create-github-pr — so runtime agent behavior depends on instruction content no client consumes.

.agents/skills/build-from-issue/SKILL.md:12-18

follow Label Discovery in `CONTRIBUTING.md` to retrieve every page of current `state:*` label definitions

vector:instruction

Counter-argument considered

Strongest case against: deferring to CONTRIBUTING.md is ordinary repo-workflow documentation and the skill adds guardrails like 'Do not hard-code label names or change disposition as part of building'; but no carve-out or mitigation covers routing label semantics, branch naming, verification, and PR-acceptance gating through files whose runtime content the artifact neither ships nor fixes, so the deferred-instruction chain stands.

Open questions 2

What the analysis could not settle from the code alone.

Unattended authorization is inferred from remote `state:*` label descriptions, maintainer assignments, and issue comments that this artifact does not fix; whether those mutable records can legitimately authorize unattended implementation cannot be settled from the shown content.

Agent hijacking

The three detector leads (DET:b800eb2cf327975a, DET:48c1e093787c1fce, DET:46f91a24481d1900) cite a claim 'Disabling this crate's feature alone does not remove dependency-owned crypto from the entire produc…' allegedly contradicted by a file_write, but that claim and any file_write are absent from the shown units: the cited excerpts are the '--json' read flag on 'gh issue view' (line 14) and the GitHub comment prefix '**🏗⟦U+FE0F⟧' (line 23), so the alleged PERSIST behavior cannot be confirmed and⟦… 99 more chars …⟧

Persistence

Coverage gaps 42

Parts of the artifact the static analysis could not fully examine.

context:manifest_unparseable yaml: YAML aliases are not permitted

.github/workflows/build-binaries.yml

context:manifest_unparseable yaml: YAML aliases are not permitted

.github/workflows/build-images.yml