Security audit

slop-detector

Security checks across malware telemetry and agentic risk

Overview

This skill is not malicious, but it asks for broader repository auditing, network checks, local history storage, and possible remediation beyond a simple AI-writing detector.

Install only if you want a broad documentation and repository cleanup auditor, not just a lightweight prose detector. Use it in report-only mode by default, avoid --track unless local scan history is acceptable, and require explicit approval before network validation, auto-apply, or delegated remediation runs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented as an AI-writing-pattern detector, but this section expands its scope into codebase auditing activities like hallucination checks, dependency validation, URL checking, config-key verification, and stub analysis. That scope creep can cause the agent to perform unexpected repository-wide inspection and network-touching tasks that users would not reasonably infer from the manifest, increasing the risk of overreach and unintended side effects.

Description-Behavior Mismatch

Low

Confidence: 91% confidence
Finding: A detector-only skill instructing the agent to invoke a separate remediation skill blurs the boundary between analysis and modification. This can lead to unexpected write actions or chained execution beyond what the user requested, especially when the current skill appears read-only from its name and description.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Registry resolution and live URL validation are external checks not obviously necessary for prose slop detection. Including them in this skill can induce unnecessary outbound network activity, expand the trust boundary, and expose the agent to dependency confusion or remote content interaction under a misleadingly narrow skill label.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Directing execution of `Skill(scribe:doc-generator)` with `--remediate` creates unjustified cross-skill action for a detector-branded skill. This increases the chance of privilege or capability expansion, where a simple analysis request cascades into content changes performed by another skill without clear user consent.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The file defines a two-layer gate where a document should pass only if both sentence-level scoring and document-economy scoring pass, but the integration summary then states that document economy alone is sufficient. That contradiction can cause an agent or human maintainer to apply the weaker rule, letting low-quality or unsafe content bypass one of the intended checks.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: This reference module is materially misaligned with the skill's declared purpose of detecting AI-generated writing patterns in prose. Instead of supporting prose-quality review, it steers the agent toward broad claims about AI-generated code defect rates and security baselines, which can bias reviews, expand scope, and cause the skill to make unsupported or irrelevant judgments in publishing or documentation workflows.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Broad triggers such as generic writing or documentation terms can cause the skill to activate in many ordinary contexts unrelated to AI-slop review. Over-triggering increases the chance that the agent applies the skill's broader audit/remediation guidance when the user did not intend it, amplifying the impact of the scope-creep issues elsewhere in the file.

Vague Triggers

Low

Confidence: 78% confidence
Finding: The malformed trigger phrase `or identity leaks before publishing` is ambiguous and may match unexpectedly or confuse routing logic. While not severe by itself, unclear activation conditions make skill behavior less predictable and can contribute to accidental invocation.

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: Defaulting to English when language detection is uncertain can cause the skill to analyze non-English text with the wrong rules, producing incorrect findings and inappropriate remediation suggestions without user consent. In a detector that may influence publication or edits, silent fallback degrades reliability and can lead to harmful false positives.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The module instructs the tool to persist detailed scan history to `.slop-history/` automatically when `--track` is used, including file paths, scores, word counts, and summary metrics, but it does not require any user-facing notice or consent about what data is being stored. In documentation/review workflows, those persisted records can reveal sensitive repository structure, document names, and longitudinal metadata, and may be retained locally longer than users expect.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The skill enforces a hard prevention rule of zero em dashes for newly generated prose and auto-invoked documentation workflows, which can override user intent and silently impose stylistic rewriting unrelated to safety or correctness. In an agent pipeline, this creates a policy-manipulation risk: generated content may be altered or blocked based on the skill author's preferences rather than explicit user requirements.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.