Security Audit

existential-birds/beagle:plugins/beagle-core/skills/fetch-pr-feedback

github.com/existential-birds/beagle

AI SkillCommit aed6fce73b77

CAUTION

Scanned 1 day ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

existential-birds/beagle:plugins/beagle-core/skills/fetch-pr-feedback received a trust score of 52/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.

SkillShield's automated analysis identified 3 findings: 1 critical, 1 high, 1 medium, and 0 low severity. Key findings include Covert behavior / concealment directives, Indirect Prompt Injection via Untrusted PR Comments, Insecure Temporary File Creation in Shared Directory.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 63/100, indicating areas for improvement.

Last analyzed on July 20, 2026 (commit aed6fce7). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

85%

Static Code Analysis

100%

Dependency Graph

100%

LLM Behavioral Safety

63%

Behavioral Risk Signals

Network Access

1 finding

Filesystem Write

1 finding

Shell Execution

1 finding

Dynamic Code

1 finding

Security Findings3

Severity	Finding	Layer	Location
CRITICAL	Indirect Prompt Injection via Untrusted PR Comments The skill fetches review comments from external contributors on a GitHub PR and passes them directly to the `receive-feedback` skill's 'verify -> evaluate -> execute' loop. Since PR comments are untrusted inputs, a malicious commenter can craft a prompt injection payload (e.g., instructing the LLM to execute arbitrary shell commands) which the LLM may then execute during the evaluation/execution phase. Avoid automatically executing instructions or commands extracted from untrusted PR comments. Implement strict sandboxing, require explicit user confirmation before executing any action derived from PR comments, and treat all fetched comments as untrusted data rather than executable instructions.	LLM	SKILL.md:31
HIGH	Covert behavior / concealment directives HTML comment containing suspicious keywords Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users.	Manifest	plugins/beagle-core/skills/fetch-pr-feedback/SKILL.md:97
MEDIUM	Insecure Temporary File Creation in Shared Directory The skill writes jq filter scripts to static paths in the shared `/tmp` directory (`/tmp/issue_comments.jq` and `/tmp/review_comments.jq`). On multi-user systems, this can lead to symlink attacks (CWE-59), allowing an attacker to overwrite arbitrary files owned by the user running the agent, or cause denial of service/race conditions. Use dynamically generated temporary file names (e.g., using `mktemp`) or pass the jq filters directly via stdin/arguments instead of writing them to static paths in a shared directory.	LLM	SKILL.md:85

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/00235946bcc25c9c.svg)](https://skillshield.io/report/00235946bcc25c9c)