40Medium
The skill is vulnerable to arbitrary code execution because it executes commands from a user-modifiable file, allowing attackers to bypass security controls and run malicious payloads.
Skill Info
Namezaingz/coding-quality-loop
Registrygithub
Versione9411d7bc68b
PURLpkg:github/zaingz/coding-quality-loop@e9411d7bc68b
Stars5
Source
SHA-2567c9d443dc0d6...
SHA-1128ee9bc6572...
MD50a6fb0973d65...
TLSH8a021a6b7395...
ssdeep192:EjJ/1kwc...
Size8,484 bytes
Install
This skill has findings worth reviewing before installing.
GitHub
Skills.shDocs
npx skills add https://github.com/zaingz/coding-quality-loopAssessments (1)
AI Agent Traps ↗Potential for arbitrary command execution via .quality-loop/allowed-commandsmediumcommand executionAML.T0050AML.T0053AML.T0072LLM05:2025LLM06:2025
The skill instructs the agent to maintain a list of allowed commands in a file and then execute them via `run-evidence`. If an attacker can influence the contents of this file, they can achieve arbitrary code execution under the guise of 'verification'. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
80% confidence
add each command to .quality-loop/allowed-commands ... so run-evidence can re-execute it.
Organization name detectedmediumpii exposureAML.T0024LLM02:2025
NER model detected organization in skill content (confidence: 0.50)
50% confidence
D****
Organization name detectedmediumpii exposureAML.T0024LLM02:2025
NER model detected organization in skill content (confidence: 1.00)
100% confidenceline 27
M**
Version History (2)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/zaingz/coding-quality-loop)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/zaingz/coding-quality-loop"><img src="https://mondoo.com/ai-agent-security/api/badge/github/zaingz/coding-quality-loop.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/zaingz/coding-quality-loop.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow