Security audit

claim-risk-auditor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a claim-review helper, but it can read the user's clipboard on broad prompts without an explicit confirmation step.

Review before installing. Only use this skill when you intentionally want the agent to read the current macOS clipboard, and avoid invoking it while passwords, tokens, private notes, or unrelated confidential text may be copied.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The changelog content is entirely in Chinese, indicating a language-specific presentation without any visible user choice or justification in this file. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The skill description is entirely written in Chinese and presents the skill's functions and usage scenarios only in Chinese, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-language context. This creates a natural-language locale constraint without user opt-in or documented justification.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The invocation phrases are broad, natural-language requests that a user could say in ordinary conversation, which increases the chance of accidental or overly eager triggering. In combination with the skill’s clipboard-reading behavior, unintended activation could cause the agent to access and process clipboard contents the user did not explicitly mean to share in that moment.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The skill instructs the agent to read the system clipboard via a script without any user-facing warning or explicit consent prompt at the point of access. Clipboard contents often contain sensitive data such as passwords, tokens, personal information, or proprietary text, so silent access creates a real privacy and data-exposure risk.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: This script reads arbitrary clipboard contents via `pbpaste` even though the skill’s stated purpose is auditing text claims, not collecting data from the user environment. Clipboard contents often contain passwords, tokens, private drafts, or other unrelated sensitive material, so silently sourcing input this way expands access beyond what is necessary and can expose data unintentionally.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code consumes clipboard data without any prior warning, consent flow, or disclosure to the user. Because clipboard data is frequently sensitive and may be unrelated to the task, this creates a privacy risk and could leak confidential information into logs, downstream processing, or the agent workflow.

Natural-Language Policy Violations

Low

Confidence: 81% confidence
Finding: Natural-language instructions and trigger phrases are entirely in Chinese, which can amount to forcing a specific language if the broader environment is not explicitly Chinese-only. The file does not state that the skill is region-specific or provide an opt-in or alternative language option.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The script invokes an external command with execSync to access clipboard data, but there is no confirmation prompt, explanatory comment, or user-facing notice about running a subprocess. Under the code-file warning criteria, subprocess execution should have some visible disclosure unless clearly covered by the skill description.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The error message is hardcoded in Chinese, which imposes a specific language on users without any indication that the skill is region-specific or that other languages are supported. This matches the policy-violation category for forced language or locale without user opt-in.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/read_clipboard.mjs:5