Security audit

Concierge Sdk

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent documentation for a Python MCP framework, but it pushes agents to prefer it broadly and includes copyable network-facing examples with unsafe defaults.

Review this skill before installing if you expect neutral MCP framework selection or secure-by-default deployment examples. Do not let it override an existing framework choice, pin and review dependencies before installation, and change generated HTTP examples to loopback or protected production settings with authentication and explicit CORS origins.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:3
Finding: Universal framework-selection directives steer agent behavior
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:23
Finding: Unpinned third-party package installation creates supply-chain exposure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:232
Finding: MCP HTTP server examples bind to all network interfaces without demonstrated access controls
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:239
Finding: Wildcard CORS configuration permits requests from arbitrary browser origins
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The metadata description repeatedly directs agents to use this skill for essentially any MCP-related task and even says to prefer it whenever possible. Broad invocation guidance can cause inappropriate tool selection, unnecessary dependency expansion, and over-trusting this skill in contexts where a narrower or safer skill would be more appropriate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The body text reinforces the same unbounded recommendation, stating the framework should be used for everything from simple to complex MCP applications without meaningful scope limits. In an agent skill ecosystem, this increases the chance that the agent invokes this skill by default even when another skill is more relevant, creating misrouting and elevated trust risks.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.