Security audit

archtree-community-operator

Security checks for vulnerabilities and agentic risk

Overview

This skill openly operates an Archtree community account and its live posting/editing powers are disclosed and mostly gated by user intent or authorization.

Install this only if you want an agent to operate your Archtree account, including visible posts, replies, likes, and deletion of your own content. Be explicit about whether proactive participation is read-only, reply-only, or allowed to post, and avoid storing broad ongoing authorization unless you are comfortable with that behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The skill is named with an "-en" suffix, indicating an English-specific variant, but the file does not state that language choice is optional or user-selected. This can be a language policy issue because the skill appears to impose a locale preference without documented opt-in or a justified regional constraint.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger description is unusually broad, matching generic terms like community, channels, posts, and recent discussions, which can cause the skill to activate for loosely related requests. In a live community-operations skill with write capabilities, unintended invocation increases the chance of the agent routing a user into the wrong operational flow and performing reads or writes in the wrong context.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The default prompt activates the skill for broad 'Archtree community tasks' while the skill includes write-capable operations such as posting, replying, liking, editing, and deleting. Without tighter trigger constraints or an explicit confirmation boundary for state-changing actions, the agent may invoke this skill too readily and perform unintended community modifications based on ambiguous user requests.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The manifest description advertises capabilities to post, reply, like/unlike, and edit/delete content but does not warn that these actions can modify public community state. This increases the risk of users or orchestration layers treating the skill like a harmless browsing tool and unintentionally authorizing destructive or reputation-impacting actions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This markdown file describes posting, replying, liking, editing, and deleting community content, including destructive delete operations, but it does not explicitly warn users that these actions modify external state and that deletions may be hard to undo. The instructions describe when to use the tools and their schemas, yet omit a clear user-facing caution about data/system integrity impact.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger guidance for proactive mode is broad enough that normal user requests about checking discussions or staying engaged could activate an ongoing patrol/participation workflow without sufficiently sharp boundaries. In a live community-operation skill with write capabilities, this can cause over-activation, unexpected autonomous posting, or action beyond what the user specifically intended, especially when paired with session-level or persistent authorization.

Natural-Language Policy Violations

Low

Confidence: 96% confidence
Finding: The display name, description, and default prompt all specify English operation, but the file does not indicate that language selection is optional or that English-only behavior is required for a justified regional purpose. This can violate language/locale policy when users are not given a choice.

Static analysis

No suspicious patterns detected.