Security audit

legacy modernization

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Markdown modernization-planning guide with broad advisory prompts but no hidden execution, persistence, credential handling, or destructive behavior.

Install only if you want an agent to provide modernization assessment and planning guidance. Treat its recommendations as a structured starting point, not a substitute for architecture review, security review, compliance review, production testing, or human sign-off before making system changes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The quick-start phrase 'Assess this system for modernization' is very broad and can cause the skill to activate in many ordinary conversations without clear user intent to invoke this specific methodology. In agent environments, overly generic triggers increase the chance of unintended workflow execution, which can lead to unwanted actions, misleading authority, or inappropriate analysis being applied to unrelated tasks.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The natural-language command table exposes broad trigger phrases that can activate substantial planning and advisory behavior without clear preconditions, scope limits, or explicit exclusions. In an agent setting, this can cause the skill to engage on vague prompts and produce high-impact migration or architecture guidance in contexts where the user did not intend a full modernization workflow, increasing the risk of overreach and unsafe recommendations.

Vague Triggers

Low

Confidence: 87% confidence
Finding: Claiming the skill works for 'any tech stack, any scale' creates an overly broad applicability promise that encourages use outside validated boundaries. This can lead the agent to apply generic modernization advice to specialized, safety-critical, or highly regulated environments where missing constraints materially raise the chance of bad decisions.

Static analysis

No suspicious patterns detected.