coding-quality-loop
The skill is vulnerable to arbitrary code execution through insecure external file loading, unverified dependency installation, and a manipulatable command whitelist that allows for command injection.
Skill Info
Install
npx skills add https://github.com/zaingz/coding-quality-loopAssessments (2)
AI Agent Traps ↗NER model detected organization in skill content (confidence: 0.75)
D****
NER model detected organization in skill content (confidence: 1.00)
M**
The `install.py` script is referenced for installing a 'control plane' without explicit mention of version pinning or integrity verification, which could lead to the installation of malicious or compromised code.
opt-in add-on installed via install.py --with-control-plane
The skill uses a `.quality-loop/allowed-commands` file to whitelist commands for re-execution. If an attacker can influence the contents of this file, they can force the agent to execute arbitrary shell commands under the guise of 'verification'.
add each command to .quality-loop/allowed-commands (one command per line, matched exactly; # comments and glob patterns allowed) so run-evidence can re-execute it.
The skill instructs the agent to load external markdown files from a `references/` directory. If these files are modified by an external actor or a compromised process, they can inject instructions into the agent's reasoning loop.
Load references/ only when needed.
Version History (3)
Badge
[](https://mondoo.com/ai-agent-security/skills/github/zaingz/coding-quality-loop)<a href="https://mondoo.com/ai-agent-security/skills/github/zaingz/coding-quality-loop"><img src="https://mondoo.com/ai-agent-security/api/badge/github/zaingz/coding-quality-loop.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/zaingz/coding-quality-loop.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow