coding-quality-loop
The skill is vulnerable to arbitrary code execution because it executes commands from a user-modifiable file, allowing attackers to bypass security controls and run malicious payloads.
Skill Info
Install
npx skills add https://github.com/zaingz/coding-quality-loopAssessments (1)
AI Agent Traps ↗The skill instructs the agent to maintain a list of allowed commands in a file and then execute them via `run-evidence`. If an attacker can influence the contents of this file, they can achieve arbitrary code execution under the guise of 'verification'. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
add each command to .quality-loop/allowed-commands ... so run-evidence can re-execute it.
NER model detected organization in skill content (confidence: 0.50)
D****
NER model detected organization in skill content (confidence: 1.00)
M**
Version History (3)
Badge
[](https://mondoo.com/ai-agent-security/skills/github/zaingz/coding-quality-loop)<a href="https://mondoo.com/ai-agent-security/skills/github/zaingz/coding-quality-loop"><img src="https://mondoo.com/ai-agent-security/api/badge/github/zaingz/coding-quality-loop.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/zaingz/coding-quality-loop.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow