voltcc-security-auditor

Several skills in this collection read and process user-provided files without clearly marking the content as data rather than instructions. Skills like accessibility-tester, architect-reviewer, chaos-engineer, and code-reviewer all read files and incorporate their content into analysis workflows. The instructions lack explicit data-boundary markers around user content references, creating potential injection surfaces where malicious file content could contain instruction-like directives.

Multiple skills declare bash tool dependencies and include instructions that could lead to shell command execution with user-provided content. The ad-security-reviewer mentions 'PowerShell or GPO-based implementation scripts' and several skills use Bash tools while processing user files. Without proper parameterization, user content containing shell metacharacters could alter command execution.

The ad-security-reviewer skill instructs the agent to perform privileged Active Directory operations like 'Enforce LDAP signing, channel binding, Kerberos hardening' and 'PowerShell or GPO-based implementation scripts' without declaring elevated privileges in its dependencies. These operations typically require domain administrator privileges.

Multiple skills contain instructions that would cause the agent to modify system configuration, install global packages, or access files outside the project scope. These operations exceed typical project boundaries and could affect system stability.

The skill declares itself as 'VoltAgent Security Auditor (Claude Code)' but contains 99,282 characters of content across multiple agent definitions including accessibility-tester, ad-security-reviewer, architect-reviewer, chaos-engineer, and code-reviewer. This massive volume mismatch between the declared single-purpose security auditor and the actual multi-agent content creates an attack surface where additional functionality could be hidden within the excessive content.

Several skills contain 'always' directives that establish persistent behavioral patterns affecting the agent's conduct across unrelated tasks. These directives lack explicit scope boundaries or termination conditions.

The security auditor skill collection contains multiple specialized agents (accessibility-tester, ad-security-reviewer, architect-reviewer, chaos-engineer, code-reviewer) that claim broad authority over system behavior, team processes, and organizational practices. While individually scoped, collectively they represent significant expansion beyond basic security auditing.

The skill contains numerous package installation commands (pip install, npm install, apt-get install, etc.) throughout various agent files that are not declared in the skill's dependencies. This creates a significant attack surface where malicious packages could be installed without user awareness or review.