Security audit

Code Simplifier

Security checks for vulnerabilities and agentic risk

Overview

This code-refactoring skill is mostly purpose-aligned, but its automatic rewrite tool can corrupt user code and lacks clear safeguards.

Install only if you will use analysis and suggestions by default, review generated changes carefully, run tests, and avoid writing output over the original file. Treat --simplify as experimental. If following troubleshooting steps, use an isolated environment and pin package and Docker versions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: references/troubleshooting.md:181
Finding: Unpinned Third-Party Package Installation Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/code_simplifier.py:472
Finding: Semantically Unsafe Source Transformations Can Corrupt Output Code
Content: View full analysis
str: """Apply early return pattern to nested conditions.""" lines = code.split("\n") result = [] i = 0 while i < len(lines): line = lines[i] # Simple pattern matching for nested ifs if ( line.strip().startswith("if ") and i + 1 < len(lines) and lines[i + 1].strip().startswith("if ") ): # Check for nested pattern indent1 = len(line) - len(line.lstrip()) indent2 = len(lines[i + 1]) - len(lines[i + 1].lstrip()) if indent2 > indent1: # Found nested if, apply early return condition = line.strip()[3:-1] # Remove 'if ' and ':' result.append(line) result.append( f"{' ' * (indent1 + 4)}return None # Early return for failed condition" ) # Skip the nested if for now (simplified) i += 2 continue result.append(line) i += 1 return "\n".join(result) ``` The boolean transformation references the generated variable before assigning it and places the assignment inside the conditional body: ```python def _simplify_boolean_expressions(self, code: str) -> str: """Simplify complex boolean expressions.""" # Simple pattern: if a and b and c: pattern = r"(if\s+)(\w+)\s+and\s+(\w+)\s+and\s+(\w+)(\s*:)" def replace_match(match): prefix = match.group(1) vars = [match.group(2), match.group(3), mat ...[truncated 3606 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The early-return rewrite injects return None immediately after an outer if, but the comment says it is for the failed condition even though the inserted return executes when the condition is true. This inverts behavior and can cause premature exits, skipped logic, and broken program behavior, making it a direct unsafe code transformation vulnerability in a refactoring tool.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises code-analysis and code-simplification workflows, including commands that read input files and write transformed output, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope boundaries can let the skill be invoked with broader file read/write capabilities than intended, increasing the risk of unintended code modification or access to unrelated files.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger description is broad enough to match very common requests such as simplifying, refactoring, optimizing, or improving code quality. Over-broad activation can cause the skill to run in contexts the user did not intend, which is riskier here because the skill also describes automated code transformation and file-handling behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: 整个技能描述和规范均以中文固定呈现，且未说明这是面向特定中文环境的受限技能，也没有提供用户可选择其他语言的机制。按政策，若技能在语言上施加强制约束，应提供用户选择或明确、合理的场景限定。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation explicitly presents an automatic simplify mode and output-writing mode but does not warn that user code may be changed, nor does it instruct the user to review diffs or back up files first. This creates a tangible integrity risk: users may apply transformations that alter behavior, remove edge-case handling, or overwrite source code without adequate review.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file title and the full troubleshooting content are written in Chinese, and the document does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The simplify() method claims to simplify code based on prior analysis and generated suggestions, but when apply_changes=True it performs hard-coded source rewrites regardless of whether those rewrites were validated as applicable. In a code-modification skill, silent semantic changes are dangerous because they can corrupt user code, introduce logic bugs, or alter control flow while presenting the output as a safe simplification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file is written entirely in Chinese and the title explicitly labels it as best practices in Chinese, but there is no indication that the skill or reference is region-specific or that users may opt into another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code file contains natural-language content in Chinese, beginning with the comment at L009 and continuing in multiple comments/docstrings below, while other user-facing text is in English. Under the policy rule, forcing a specific language or mixed locale without user opt-in or documented justification can violate language/locale expectations for maintainers or users.
Content: No source excerpt is available for this finding.