Security audit

OpenMerge

Security checks for vulnerabilities and agentic risk

Overview

The skill advertises a simple hello response but also describes install-time workspace creation and broker/Discord-related data handling that are not coherently scoped.

Review this skill carefully before installing. It has no bundled executable code, but its instructions and metadata describe persistent local files and external-facing broker/Discord behavior that do not match its simple hello description.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill metadata and description claim it is a simple 'say hello' skill, but the body documents broader behavior involving merge actions, lifecycle hooks, workspace creation, broker uploads, and Discord-related files. This mismatch is dangerous because it can mislead reviewers and users about the actual scope of the skill, reducing informed consent and masking external data-handling behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrase 'When the user asks to merge' is broad and ambiguous, making accidental or unintended activation more likely. In a skill whose documented scope is inconsistent, broad activation increases the chance that users invoke behavior they did not expect, especially if the skill has installation hooks or external-facing functionality.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill states that some sensitive files are never transmitted while also documenting that other workspace data is uploaded to a broker or posted to Discord. In the context of a supposedly simple hello skill, these external data-handling statements create a misleading trust boundary and may expose user metadata or social/contact information unexpectedly.
Content: No source excerpt is available for this finding.