Security audit

Grant Mock Reviewer

Security checks for vulnerabilities and agentic risk

Overview

This grant-review skill is purpose-aligned and local-only, but users should handle proposal files and generated outputs as sensitive.

Install in an isolated environment, preferably after removing the unnecessary requirements. Use TXT or MD inputs for accurate review because PDF/DOCX extraction is not implemented. Save outputs only to intentional workspace paths and avoid overwriting existing files, since generated reviews may contain sensitive proposal-derived content.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unnecessary and Unpinned Third-Party Dependencies Create Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:580
Finding: Caller-Controlled Output Path Permits Arbitrary File Overwrite Within Process Privileges
Content: View full analysis
Remediation: View remediation
Path: candidate = (OUTPUT_ROOT / value).resolve() try: candidate.relative_to(OUTPUT_ROOT) except ValueError: raise ValueError("Output path must remain inside the output directory") if candidate.exists(): raise FileExistsError(f"Refusing to overwrite existing file: {candidate}") if candidate.is_symlink(): raise ValueError("Symbolic-link output destinations are not permitted") return candidate ``` For stronger protection against time-of-check/time-of-use races, create the destination atomically with exclusive flags such as `O_CREAT | O_EXCL | O_NOFOLLOW` where supported. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises file read/write behavior via its CLI and library usage, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. This creates a capability mismatch: an orchestrator or reviewer cannot reliably constrain what files the skill may access, increasing the risk of unintended file reads, overwrites, or use on sensitive proposal materials.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description uses broad trigger terms like 'mock review, critique, or evaluation of a grant proposal,' which can activate the skill in loosely related contexts without a precise boundary. Over-broad activation is dangerous because the skill processes local files and writes outputs, so accidental invocation could expose sensitive proposal content or perform unintended file operations during unrelated user requests.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI advertises support for proposal files in PDF and DOCX formats, which is consistent with the skill's stated purpose of reviewing grant proposals. However, for those formats the code does not extract proposal content at all; it substitutes a placeholder message, meaning the resulting review is based on the placeholder text rather than the actual proposal.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 60% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
dataclasses enum

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 60% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
dataclasses enum

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: In comparison mode, the script writes generated review content derived from proposal files directly to the path given by --output. Although the operation is part of the tool's purpose, there is no explicit user-facing disclosure at the write point that the output may contain sensitive proposal material or reviewer-style summaries, which is relevant for a skill handling potentially confidential research content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The script saves the generated summary statement and recommendations to a user-specified output file, but does not explicitly warn that this persists content derived from the input proposal. For a skill processing grant proposals, a user-facing disclosure about writing potentially sensitive analysis output would improve safety and transparency.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.