Security audit

Jewish Hebrew Text Tools

Security checks for vulnerabilities and agentic risk

Overview

This is a small offline Hebrew text utility with some accuracy and activation-scope caveats, but no hidden access, persistence, network behavior, or destructive capability.

Before installing, understand that this skill may activate for broad Hebrew-related prompts and its transliteration is Ashkenazi-style only, with a known Tav mapping accuracy issue. From a security perspective, it stays local and does not request sensitive access.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The listed triggers include very broad phrases such as "gematria," "hebrew letters," and especially "hebrew text," which can overlap with ordinary discussion rather than a clear request to invoke the skill. The manifest does not provide exclusion conditions or tighter context to distinguish when the skill should activate versus when Hebrew is merely being discussed.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This code explicitly declares an "Ashkenazi-style" transliteration mapping, which imposes a specific linguistic convention on all users. Under the policy, forcing a particular language or locale variant without offering a choice can be a natural-language policy violation.

Intent-Code Divergence

Medium

Confidence: 99% confidence
Finding: The mapping first assigns 'ת' to 't' and then reassigns the same key to 's', so Python keeps only the later value. This directly contradicts the inline comment on L071 stating to keep 't' for Ashkenazi, creating an intent-code divergence in a core advertised feature.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The documentation states that transliteration uses "Ashkenazi-style pronunciation," which enforces a specific language/locale convention. The file notes in limitations that Sephardi variants are not supported, but it does not offer user choice or explicit opt-in for this style.

Description-Behavior Mismatch

Low

Confidence: 96% confidence
Finding: The manifest and module docstring present this as a Hebrew text utilities skill focused on transliteration, gematria, nikud removal, letter identification, and number formatting. The additional reverse() capability is a separate text transformation not reflected in the stated scope, and it is exposed as a CLI feature.

Static analysis

No suspicious patterns detected.