Security audit

collab-offer-polisher

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Chinese-language collaboration-message polisher, but it reads and prints the user's system clipboard without a clear consent or scoping step.

Install only if you are comfortable with the agent reading whatever is currently on your clipboard when the skill is invoked. Prefer pasting the exact text into chat, or require the skill to ask before reading the clipboard and to avoid printing unrelated clipboard contents.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The natural-language description and invocation examples all specify the skill behavior in Chinese, which can imply a forced language/locale experience. There is no indication that users may choose another language or that the Chinese-only scope is intentional and justified as region-specific.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to read the user's clipboard via `pbpaste`/`read_clipboard.mjs` without any visible consent prompt, preview, or warning that clipboard contents may include unrelated secrets such as passwords, tokens, personal messages, or confidential documents. This creates an unnecessary data-exposure path because the user request is about polishing collaboration text, but the implementation silently broadens access to whatever happens to be in the clipboard at that moment.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script accesses the host clipboard via `pbpaste`, which is a system-level data source that may contain passwords, tokens, personal messages, or unrelated confidential material. For a skill whose purpose is polishing collaboration offers, silently pulling arbitrary clipboard contents is broader than necessary and creates avoidable data exposure risk, especially because the contents are then emitted to stdout.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code reads clipboard contents through a subprocess and prints them between markers without any prior warning or confirmation. This can disclose sensitive clipboard data into logs, terminal history, agent transcripts, or downstream tooling even when the user did not intend to share whatever was last copied.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: This markdown file contains user-facing natural language exclusively in Chinese ('初始版本', '支持合作文案润色', '支持正式版、亲和版、成交导向版改写') with no indication that the skill is intended only for Chinese-speaking users or that language selection is optional. That can violate the language/locale policy because it implicitly forces a specific language without user opt-in.

Natural-Language Policy Violations

Low

Confidence: 87% confidence
Finding: The README describes the skill entirely in Chinese, including its purpose, features, and usage scenarios. For a general-purpose skill, this can function as an implicit language constraint without documenting a user language choice or stating that the skill is region-specific.

Natural-Language Policy Violations

Low

Confidence: 98% confidence
Finding: The script emits its user-facing error message only in Chinese, with no mechanism for language selection or fallback. This creates a language policy concern because it imposes a specific locale on users regardless of their preferences.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/read_clipboard.mjs:5