Security audit

Adaptive Suite

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it asks for broad assistant powers, a third-party API key, and NAS metadata scanning without enough scoping or privacy controls.

Install only if you are comfortable with a broad assistant skill that may use a third-party API hub and inventory NAS filenames, metadata, and directory structure. Require explicit folder selection before any NAS scan, keep collected metadata local unless you approve sharing it, use a scoped revocable API key, and review any generated desktop app before running it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill is scoped extremely broadly across coding, business analysis, project management, web development, data analysis, and NAS scraping without clear invocation boundaries or least-privilege constraints. Overbroad skills increase the chance that an agent will apply the skill in inappropriate contexts, combine sensitive capabilities, or use external tools and credentials where the user did not expect it.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The manifest declares an external API endpoint and requires an API key, but provides no user-facing disclosure that prompts, project data, or other content may be transmitted off-system. In an agent setting, this can lead to silent data exfiltration to a third-party service and use of sensitive credentials without informed consent.

Static analysis

No suspicious patterns detected.