Security audit

cs

Security checks for vulnerabilities and agentic risk

Overview

This is a simple summarization skill that uses an LLM on the user's message, with no evidence of hidden persistence, credential access, local file access, or destructive behavior.

Install only if you want automatic summarization. Be aware it may run on long messages even without a direct summary request, and do not paste confidential, regulated, or private text unless your configured LLM provider is acceptable for that data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: summarizer.ts:13
Finding: Untrusted Message Content Is Directly Interpolated into the LLM Prompt
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The trigger terms include generic words like 'brief' and broad regex matching, which may collide with normal conversation and activate the skill outside the user's intended context. Because the skill is designed for automatic activation, weakly scoped keywords make accidental processing more likely and can lead to unintended handling of user content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill auto-activates on any pure-text input over 100 characters even without an explicit user request, which can cause unsolicited processing of ordinary conversations, emails, or other sensitive content. In an agent setting, broad implicit triggers increase the chance of accidental invocation, privacy overreach, and unexpected behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Natural-language strings instruct the assistant to operate in Chinese (请总结..., 你是一个专业的摘要助手) and the skill metadata is also Chinese-only. The file does not offer opt-in language selection or explain that this is a region-specific skill, which creates a locale policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill forwards the entire user message directly to an external LLM for summarization, and this file contains no notice, consent flow, or minimization logic before transmission. If users paste sensitive personal, confidential, or regulated data, that data may be unnecessarily disclosed to the model provider, creating privacy and compliance risk even though the feature itself is expected to summarize text.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.