Security audit

modular-skills

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only skill for designing modular skills; it has some broad activation and command-example caveats but no hidden execution, persistence, or data access behavior.

Install only if broad skill-design guidance is wanted. Before running any example commands, especially chmod, pip install, or local validation scripts, check that the referenced scripts and directories are the intended ones.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · modules/optimization-techniques.md (reported line 68)May include surrounding context.
md
- Merge similar functions with parameterization - Replace code blocks with structured data where appropriate - Implement progressive loading for non-essential content - Update skill documentation to reference external tools ### Phase 4: Validation - Verify line count <300 (target: 150-200)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list contains broad generic terms like 'architecture', 'modularity', 'skills', and 'design-patterns', which can cause the skill to activate in many unrelated conversations. In an agent environment, overbroad activation can inject unsolicited instructions and alter behavior outside the user's intent, increasing prompt-surface and workflow interference risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The markdown includes a recursive chmod +x command that changes permissions on all files under scripts/, which can materially affect system state. The surrounding text presents it as a troubleshooting step but does not warn users about its broad impact or advise verification before running it.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The instruction to always use third-person perspective rather than "you" or "your" is a natural-language constraint that forces a specific communication style regardless of user preference. This can conflict with organizational language-choice policy when no user opt-in or justification is provided.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document says the current pattern is that each skill owns its modules and explicitly deprecates skills/shared/modules/ usage, with the validator flagging remaining shared directories (L050-L055). But the 'Shared Modules' resources immediately direct readers to ../shared-patterns/modules/..., which contradicts the stated ownership guidance and could mislead developers about the intended architecture.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown/manifest content describes the skill in very general terms as covering implementation patterns and best practices for building modular skills. It does not provide specific trigger phrases, scope boundaries, or negative examples, which could make invocation conditions ambiguous in systems that rely on descriptions for activation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.