40Medium
The skill is vulnerable to prompt injection because it dynamically loads and executes instructions from external markdown files that can be manipulated by an attacker.
Skill Info
Namezaingz/coding-quality-loop
Registrygithub
Version9f912928bd42
PURLpkg:github/zaingz/coding-quality-loop@9f912928bd42
Stars5
Source
SHA-2569e4f308a02b2...
SHA-19768be427457...
MD5ba99932baa5a...
TLSH03120a677399...
ssdeep192:ECJ/Yvkw...
Size9,201 bytes
Install
This skill has findings worth reviewing before installing.
GitHub
Skills.shDocs
npx skills add https://github.com/zaingz/coding-quality-loopAssessments (2)
AI Agent Traps ↗Potential for indirect prompt injection via referencesmediumindirect prompt injection
The skill instructs the agent to load external markdown files (`references/*.md`) on demand. If these files are modified by an attacker, they can inject instructions into the agent's reasoning process. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
70% confidence
Load references/ only when needed.
Organization name detectedmediumpii exposureAML.T0024LLM02:2025
NER model detected organization in skill content (confidence: 0.75)
75% confidence
D****
Organization name detectedmediumpii exposureAML.T0024LLM02:2025
NER model detected organization in skill content (confidence: 1.00)
100% confidenceline 27
M**
Version History (3)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/zaingz/coding-quality-loop)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/zaingz/coding-quality-loop"><img src="https://mondoo.com/ai-agent-security/api/badge/github/zaingz/coding-quality-loop.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/zaingz/coding-quality-loop.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow