Security audit

policy-to-checklist

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent checklist purpose, but it can read and print the full system clipboard without a clear warning or confirmation step.

Review this skill before installing if your clipboard may contain passwords, keys, personal data, or confidential work. Use it only when you intentionally copied the document you want processed, and prefer pasting the text directly if you do not want clipboard access.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The skill description is entirely written in Chinese and does not indicate that other languages are supported or that Chinese is required for a region-specific purpose. This can constitute a language/locale policy violation because it implicitly constrains usage to a specific language without user opt-in.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs running a script that reads the system clipboard, which can contain sensitive data such as passwords, API keys, personal information, or unrelated confidential text. Because the skill provides no warning, consent step, or preview of what will be accessed, it creates an unnecessary risk of collecting and processing sensitive data beyond the user's clear intent.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script automatically reads the system clipboard and prints its full contents, even though the skill’s stated purpose is converting provided policy-like documents into checklists and timelines. Clipboard access can expose unrelated sensitive data such as passwords, API keys, internal documents, or personal information, making the capability over-privileged for the declared function.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: At line 5, the script invokes pbpaste via subprocess to read whatever is currently on the clipboard without prior notice or confirmation. Because clipboard contents often contain sensitive transient data, this creates an unnecessary data exposure path, especially since the script then emits the data to stdout where it may be logged, captured by tooling, or forwarded to other components.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The markdown text uses Chinese for user-facing changelog entries, but the file does not state that the skill is intended for Chinese-speaking users or offer any language choice. This can violate a language/locale policy when users are not given an opt-in or justification for the enforced language.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The natural-language instructions and invocation examples are all presented in Chinese, which can amount to a fixed language policy if users are not offered an alternative. There is no indication that the skill supports other languages, asks for user preference, or is intentionally limited to a Chinese-language context.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The error message is presented only in Chinese, which imposes a specific language on users without opt-in or documented locale scoping. This can violate language/locale policy when the skill is not explicitly limited to Chinese-speaking contexts.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/read_clipboard.mjs:5