Security audit

Skill Alchemy Main

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its stated skill-generation purpose, but it needs review because it pulls untrusted public skill text into generated agent instructions and its metadata advertises sensitive capabilities that the artifacts do not scope.

Review the root skill, Lens, and LEAP before installing. Avoid all-default mode for sensitive or private tasks, assume public skills fetched from skills.sh or GitHub may contain hostile prompt content, and inspect any generated SKILL.md before copying it into ~/.claude/skills. The financial/credential capability tags should be treated as unexplained until the publisher clarifies or removes them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (38)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill instructs live retrieval from skills.sh, GitHub raw, and potentially other online sources without a clear trust boundary, allowlist, or consent gate. That broadens the skill from internal compilation into arbitrary remote content ingestion, which creates prompt-injection, untrusted-content, and data-exfiltration risk if remote artifacts are malicious or manipulated.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill presents itself as a description-enhancement component but conditionally instructs the agent to perform WebSearch and WebFetch. This expands the skill's effective privileges beyond its stated role, creating a capability mismatch that can surprise upstream orchestrators, leak user task context to external services, or pull in untrusted content during what appears to be a purely local reasoning step.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: Embedding external web search/fetch into a cognitive-analysis skill is risky because it introduces unnecessary retrieval of untrusted external content into a stage that should mainly restructure user intent. If exploited through crafted inputs, this can cause prompt-influenced searches, contaminate outputs with attacker-controlled web content, or expose sensitive task details to third parties.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The README explicitly instructs users to pull the repository locally and install it into Claude Code skills, but it does not warn that doing so imports unreviewed third-party prompt/code content into the local agent environment. In an agent-skill ecosystem, installation changes the model's available behavior and may introduce unsafe instructions or side effects, so lack of a review warning is a real supply-chain safety issue even if the text itself is not overtly malicious.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The README promotes direct installation of bundled skills from a repository path, again without warning that these skills may alter local agent behavior or contain unsafe prompt logic. This is slightly more dangerous in context because the repository advertises '大量开箱即用的 Skill' and encourages one-command installation of individual subskills, increasing the chance that users will install nested content they have not audited.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly advertises an "All default" mode that skips all interactions, but it does not clearly warn users that this may trigger autonomous research, installation, or skill-generation actions with reduced human review. In the context of an agent skill that pulls external content and compiles installable artifacts, suppressing checkpoints increases the risk of unintended actions, unsafe installations, or prompt-injection exposure from upstream sources.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill writes multiple files and later deletes artifacts, but it does not require a user-facing notice or confirmation before performing those data-affecting operations. In an agent setting, silent workspace creation and cleanup can overwrite expected outputs, remove evidence, or surprise users about what was stored locally.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill performs remote retrieval and downloading of candidate SKILL.md files and exemplars without prominently warning the user that external services will be contacted. This is dangerous because it can leak prompts or metadata to third parties, import adversarial content into the workflow, and violate user expectations around offline or local-only processing.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrases are very broad everyday requests such as '分析一下这个需求' and '帮我生成一个 skill', which can cause the skill to activate in situations where the user did not explicitly intend to invoke this capability. In an agent environment, over-broad activation increases the chance of unintended orchestration, scope expansion, or hijacking of generic conversations into skill execution.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger examples are broad and overlap with common user requests such as 'Analyze this requirement' and 'Generate a skill from this'. In an agent ecosystem, this can cause unintended invocation of the Lens skill in situations where the user did not explicitly request it, potentially steering workflows, consuming resources, or inserting hidden pre-processing into downstream tasks.

Vague Triggers

High

Confidence: 91% confidence
Finding: The trigger phrases are broad enough to match common requests such as 'analyze this' or 'help me think,' which can cause the skill to activate unexpectedly in many unrelated conversations. Because this skill can then reshape prompts and potentially invoke external search, overbroad activation increases the blast radius of any unsafe behavior and undermines user and orchestrator intent.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The workflow explicitly promotes `/run <cmd>` and `!<cmd>` shell execution without a nearby warning that these commands execute arbitrary shell commands on the user's machine. In an agent-skill context, especially one guiding users through LLM-assisted workflows, this increases the risk that users will run destructive, exfiltrating, or otherwise unsafe commands suggested by the model or copied from untrusted context.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The repeated-correction trigger relies on ambiguous criteria like the same correction being typed in chat multiple times, but it does not define session scope, actor scope, or whether the correction must be explicitly approved for persistence. This can let incidental chat corrections become durable agent instructions, creating prompt-persistence risk and accidental policy drift in the codebase.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The repeated-correction trigger relies on ambiguous criteria like the same correction being typed in chat multiple times, but it does not define session scope, actor scope, or whether the correction must be explicitly approved for persistence. This can let incidental chat corrections become durable agent instructions, creating prompt-persistence risk and accidental policy drift in the codebase.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: OP-5 uses broad phrases such as 'same mistake twice' and 'should have known,' which delegate substantial judgment to the agent when deciding to append new persistent rules. In a skill whose purpose is to author and evolve agent-loaded convention files, this looseness increases the chance of overfitting transient preferences into durable instructions that affect future behavior across sessions.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger for OP-1 activates on very common concepts like 'team', 'collaboration', or any explicit CrewAI mention, which can cause the skill to engage in situations where the user did not actually intend framework selection. In an agent-routing context, overly broad activation conditions can lead to incorrect tool/skill invocation, unnecessary workflow branching, and propagation of inappropriate advice into later steps.

Vague Triggers

Low

Confidence: 83% confidence
Finding: Using 'Pre-deployment checklist' as the activation condition is broad enough to match many unrelated deployment workflows, potentially causing this skill to insert observability hooks, callbacks, or runtime limits where they were not intended. In multi-skill agent environments, such broad matching can create accidental invocation and unexpected logging or instrumentation behavior, which may affect privacy, reliability, and control boundaries.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger for upgrading to Flow includes broad conditions like 'conditional routing required' or 'multiple Crews must chain,' which are common across many orchestration tasks. In an agentic system, this can cause the skill to over-assert CrewAI/Flow as the solution and redirect workflows away from safer or simpler alternatives, creating control-flow confusion and unintended framework coupling.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation conditions are broad enough to trigger on generic framework-selection or project-kickoff discussions, which can cause the skill to run when the user did not explicitly ask for this decision tree. In an agentic system, overbroad invocation can steer conversations, consume context budget, and bias architectural decisions unexpectedly, even without overtly malicious content.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document explicitly recommends logging full queries, retrieved nodes, scores, index IDs, and full LLM prompts for every failure. In a production RAG system, those artifacts often contain sensitive user inputs, proprietary corpus content, secrets embedded in context, or personal data, so indiscriminate failure logging can create a secondary data-exposure channel even if the main application is otherwise secure.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The document includes an absolute local filesystem path pointing to a specific user's home directory and workstation layout. While this does not directly enable code execution, it leaks environmental details that can aid social engineering, targeted phishing, path-guessing, or correlation of internal development artifacts.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: This finding again exposes a user-specific absolute local path in documentation, revealing local directory structure and username-like identifiers. Repeated disclosures increase the quality of environmental reconnaissance available to an attacker, especially when combined with other leaked repository or workflow details.

Natural-Language Policy Violations

Low

Confidence: 98% confidence
Finding: The source file list contains multiple absolute local paths, disclosing machine-specific filesystem structure and likely the author's local username. In this skill context, the file is reference documentation rather than executable code, so the danger is limited to information disclosure; however, aggregating these paths still creates avoidable operational metadata leakage.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The activation rule is defined so broadly that the overlay may trigger on virtually every newly added LM-calling node, regardless of whether shape selection is actually uncertain or needed. In an agentic system, this can create persistent over-application of the skill, increasing prompt/control-surface exposure, causing unintended behavior steering, and making downstream workflows harder to reason about.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly recommends `dspy.ProgramOfThought`, describes generated code being executed, and provides no warning or guardrails about running LLM-generated code. In this context, that can normalize unsafe execution of model-produced code and expose the host environment to arbitrary code execution, data access, or side effects if users follow the guidance naively.

VirusTotal

49/49 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.