Skill Creator 0.1.0

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:13 AM UTC
• Version: 1.0.0

Overview

This skill is mostly purpose-aligned for creating skills, but its helper packager can accidentally include sensitive files through symlinks and its initializer can write outside the intended output directory.

Install only if you are comfortable with local file-creation and packaging helpers. Avoid running the bundled scripts on untrusted skill directories, do not package directories containing symlinks, and use simple hyphen-case skill names in a dedicated workspace until the path validation and symlink handling are hardened.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init_skill.py:188

Finding

Output Directory Escape Through an Unvalidated Skill Name

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/package_skill.py:68

Finding

Symbolic-Link Following Can Disclose External Files in Packaged Archives

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims to help create or update skills, but it also instructs automated validation of local directories and metadata via CLI scripts. This broadens behavior from advisory guidance into active local inspection and build orchestration, increasing the chance of unintended file access or execution under an overly general description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims to help create or update skills, but it also instructs automated validation of local directories and metadata via CLI scripts. This broadens behavior from advisory guidance into active local inspection and build orchestration, increasing the chance of unintended file access or execution under an overly general description.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

md

1. Understand the skill with concrete examples
2. Plan reusable skill contents (scripts, references, assets)
3. Initialize the skill (run init_skill.py)
4. Edit the skill (implement resources and write SKILL.md)
5. Package the skill (run package_skill.py)
6. Iterate based on real usage

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.

md

Any example files and directories not needed for the skill should be deleted. The initialization script creates example files in `scripts/`, `references/`, and `assets/` to demonstrate structure, but most skills won't need all of them.

#### Update SKILL.md

**Writing Guidelines:** Always use imperative/infinitive form.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/init_skill.py (reported line 266)May include surrounding context.

python

# Print next steps
    print(f"\n✅ Skill '{skill_name}' initialized successfully at {skill_dir}")
    print("\nNext steps:")
    print("1. Edit SKILL.md to complete the TODO items and update the description")
    print("2. Customize or delete the example files in scripts/, references/, and assets/")
    print("3. Run the validator when ready to check the skill structure")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs the agent to run local scripts, create directories, test code, and package artifacts, which implies shell, filesystem read/write, and potentially network-adjacent capabilities, yet it declares no explicit tool scope or permissions. This creates an overbroad and underdocumented execution surface where a consuming system may grant default tools without clear least-privilege boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation language is broad enough to match many generic requests about creating or updating skills, increasing the probability of accidental triggering. Because the skill includes instructions to run scripts, edit files, and package artifacts, over-triggering raises the risk of the agent performing higher-impact actions in contexts where only advice was expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code creates directories, writes several files, and changes file permissions in the user-supplied path. Although it prints progress messages, those messages do not warn the user in advance that the command will scaffold files on disk, and the module docstring/usage text also lacks a clear disclosure of these side effects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.