Security audit

Brainstorming Pro

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a normal brainstorming aid, but it can read project context and persist brainstorming/design output into a repository without clear separate user approval.

Install only if you are comfortable with the agent inspecting repository context and, after ideation, writing a design document and committing it to git. For safer use, ask the agent to keep brainstorming in chat unless you explicitly approve file creation, commits, recordings, or worktree setup.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Committing changes to git and creating isolated workspaces are powerful repository-modifying operations unrelated to core brainstorming facilitation. If triggered implicitly, the skill could alter repository state, create audit noise, or persist low-quality or sensitive material without clear user intent, making the mismatch especially dangerous in an otherwise benign ideation context.
Content: No source excerpt is available for this finding.

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · assets/handoff-protocol.md (reported line 231)May include surrounding context.
md
## Recommendation **[Clear Statement of Recommendation]** ## Strategic Rationale

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The catch-all invocation language ('any scenario requiring divergent thinking') is overly broad and can cause the skill to be selected in contexts outside its safe or intended operating envelope. Over-broad routing increases the chance that users invoke a skill with hidden repo/design side effects when they expected lightweight ideation help.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Instructions to inspect the current project state, files, docs, and recent commits introduce repository-reading behavior that is not clearly necessary for a brainstorming skill. In context, this broadens data access beyond ideation and may expose sensitive project information under the guise of a low-risk facilitation tool.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented workflow moves from ideation into architecture/design presentation, implementation setup, and planning, which materially exceeds the declared brainstorming role. This is dangerous because orchestration layers and users may grant or invoke the skill under weaker assumptions than its actual behavior warrants.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill’s advertised purpose is brainstorming facilitation, but these instructions extend into generating formal design artifacts and persisting them in the repository. That scope expansion can cause users or calling systems to invoke a seemingly low-risk ideation skill that unexpectedly performs project-modifying actions, creating a capability mismatch and reducing informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs writing a design file and committing it to git without an explicit warning or consent flow for modifying files and repository state. This is dangerous because users may experience unintended persistence and version-control changes from what appears to be a conversational brainstorming tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing instructions and templates exclusively in German, which can constitute a language/locale policy violation when no opt-in or alternative language path is provided. The file does not indicate that the skill is intentionally limited to German-speaking users or a German-specific compliance context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file consistently instructs users in German, including the title, templates, and workflow guidance, but does not state that the skill is German-only or provide any opt-in for language selection. Under the policy, forcing a specific language without user choice is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document is written in a hybrid of German and English terms and headings, such as the title, metric labels, and report templates. Under the policy, forcing a specific language or locale without user opt-in can be a violation, and this file does not state that it is intended only for German-speaking users or offer an alternative language option.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file presents its usage instructions and scripts in German from the title onward, which effectively forces a specific language for users. The file does not offer an opt-in language choice or explain that the skill is intended only for a German-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The title and usage description are written in German and present the template as the standard format, implying outputs should be produced in German by default. This is a natural-language policy concern because it fixes a language choice without offering the user an explicit language or locale option.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document recommends recording remote sessions as a workaround for timezone issues but does not mention obtaining participant consent, disclosing recording, or handling retention and access. In many workplaces and jurisdictions, undisclosed or poorly governed recording can expose personal data, create legal/compliance risk, and chill participation in brainstorming sessions where candid speech is expected.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file is largely written in German but repeatedly embeds English terms and phrases such as 'Deep-Dive', 'Use', 'Workshop', and many English labels throughout. Under the policy rule for natural-language violations, forcing a mixed language/locale experience without user opt-in or a documented locale constraint can violate language consistency expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide declares its intended use in German ('Als Facilitator Session moderieren') and the document content is predominantly German, which effectively imposes a specific language/locale on users. The file does not offer an English or user-selected alternative, nor does it justify a region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This markdown file is primarily written in German, but it embeds numerous English terms such as framework names, labels, and facilitation prompts. Under the language/locale policy rule, forcing or assuming a mixed language presentation without explicit opt-in can be a policy concern for users expecting a consistent locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file contains user-facing instructional content exclusively in German, and there is no indication that the skill is region-specific or that users can opt into this language. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Line L001 states the skill is a decision tree 'für Brainstorming-Techniken', and the document consistently presents facilitator guidance in German without offering any language choice. This can violate language/locale policy when users are not given an explicit opt-in or alternative language option.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The handoff table mixes German and non-German labels, including the Chinese label '交付物', without explaining locale expectations or offering a user choice. This creates an undocumented language/locale constraint and inconsistency that can conflict with organizational language policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The document consistently uses mixed-language instructions such as German, English, and isolated Chinese terms, but does not state a supported language preference or let the user opt into that format. This can violate a language/locale policy when content presentation is forced without documented choice or justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.