Security audit

skill-optimizer

Security checks for vulnerabilities and agentic risk

Overview

This skill is designed to improve other skills, but its optional automated workflow can change and commit skill files across the workspace, so it should be reviewed before installation.

Install only if you are comfortable letting this skill modify other skills. Prefer analyze-only use first, review diffs manually before applying optimization, and avoid enabling the weekly cron or git auto-commit behavior unless you add a confirmation or dry-run gate.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The README states the skill will automatically commit optimization changes to git, which expands its behavior from document analysis into repository mutation. Even if intended as convenience, automatic commits can persist unwanted or unsafe edits, obscure review, and create durable changes without explicit user approval.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Automatic git commit capability is not clearly necessary for a skill whose primary purpose is analyzing and optimizing skill documents. This creates unnecessary privilege and side effects: if the optimization logic is flawed or manipulated, the skill can persist changes into version history and affect downstream automation or collaborators.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script’s documented purpose is analysis/reporting, but it also performs `git add` and `git commit` on the workspace. In an automated cron context, this creates an integrity risk: any prior or concurrent modifications under `skills/` will be silently persisted, including unintended, unreviewed, or malicious changes introduced by other processes. The skill context makes this more dangerous because skill documents are treated as operational agent instructions, so committing poisoned skill content can normalize and retain harmful behavior.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Automatic commit capability is broader than the stated reporting function and lacks clear justification or safeguards. Even though this script does not itself modify `skills/`, `git add skills/` can capture any modifications already present in that path, making the cron job a persistence mechanism for unauthorized or accidental changes. In this skill ecosystem, that is meaningful because committed skill changes can affect future agent behavior and trust in the workspace.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README describes automated optimization of skill files and repository commits but does not prominently warn users that files and git history may be modified. In an automated cron context, this omission increases the chance of silent, recurring changes that users did not fully understand or authorize.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: Optimize mode explicitly instructs the agent to copy backups and write changes to SKILL.md, but it does not require an explicit warning or confirmation before modifying files. In an agent setting, silent file mutation can cause unintended edits, overwrite user work, or surprise users who expected analysis-only behavior.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: Batch optimization can operate on multiple skills and includes optimization steps that may modify several files, yet it does not warn that this scope can affect many workspace artifacts at once. In multi-file agent workflows, lack of scope disclosure increases the risk of accidental broad changes, especially when the default behavior optimizes the top N skills automatically.

Self-Modification

High

Category: Rogue Agent
Content: | Reflect (analyze trajectories) | Score 10 quality dimensions, identify weaknesses | | Aggregate (merge patches) | Combine related improvements | | Select (learning rate) | Max 4 edits per pass (prevents overfitting) | | Update (apply to doc) | Edit SKILL.md with bounded changes | | Gate (validate) | Re-score, only accept improvements | | Slow update | Gradual improvement across passes | | Meta skill | Cross-skill patterns → better rubric |
Confidence: 95% confidence
Finding: This skill is explicitly designed to edit SKILL.md files, which is a self-modification capability affecting agent behavior rather than just content. In context, that makes the risk more serious because altering skill instructions can change future execution patterns, propagate unsafe guidance, or weaken safeguards across the workspace if the optimization criteria are incomplete or subverted.

Static analysis

No suspicious patterns detected.