Security audit

Screenshot To Task

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local screenshot-to-task formatter with disclosed Python use and no evidence of networking, persistence, credential access, or destructive behavior.

Install only if you are comfortable with a local Python helper. Provide only screenshot text or files you intend it to read, avoid sensitive screenshots unless redacted, and write output to a location you control. The dormant audit code and placeholder homepage are reasons to review the package source, but they do not show active malicious behavior in this version.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill declares no permissions, yet its instructions explicitly allow invoking `python3` and imply reading local resources and writing output files. This creates a capability/permission mismatch that can surprise users or hosting platforms, weaken auditability, and enable unintended local file access or shell execution if the skill is invoked in a more permissive runtime.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The script’s implemented behavior materially exceeds the declared purpose of a screenshot-to-task skill. It can inspect arbitrary files, directories, CSV/TSV data, and skill package contents, creating a capability mismatch that could be abused to analyze local workspace contents unrelated to user screenshots, increasing the risk of unintended data exposure and covert repurposing.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Embedding security-oriented pattern scanning for secrets, dangerous shell commands, and private URLs is unrelated to screenshot task extraction and enables inspection of arbitrary local content for sensitive data. Even though it only reports matches, this can surface confidential tokens, internal endpoints, or command snippets from files the user did not intend this skill to process.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The code can recursively enumerate arbitrary directories and inspect skill package metadata/files, which is unjustified for the advertised screenshot workflow. In context, that mismatch makes the capability more dangerous because users may grant access expecting simple task extraction, while the script instead inventories repository contents and extracts headings or metadata from local files.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The CLI description presents the script as a generic support utility for the skill while the real operations are repository, data, and pattern auditing. Misleading interface text can cause users or higher-level agents to invoke it with sensitive local paths under false assumptions, amplifying the impact of the undeclared auditing features.

Static analysis

No suspicious patterns detected.