Lean Context

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:23 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a token-optimization guide, but it advises disabling agent approval controls without safeguards.

Review this skill before installing. Its general token-saving advice is conventional, but do not follow the `--no-ask-user` or `--allow-all` recommendation unless you are in a disposable, tightly scoped environment with no secrets, production access, or destructive permissions. Keep confirmations enabled for file writes, command execution, credential access, network calls, deployments, and public-facing actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:198

Finding

Unsafe Recommendation to Disable Agent Confirmation and Permission Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 198
Vulnerability Type: Unsafe agent configuration guidance
Risk Level: Medium

Vulnerable Code

markdown

- `--no-ask-user` / `--allow-all` flags reduce confirmation round-trips

Technical Analysis

The Skill recommends disabling interactive confirmation or broadly allowing agent operations as a token-efficiency measure. These controls are security boundaries intended to ensure that sensitive tool actions receive explicit authorization. Disabling them is unnecessary for the Skill's stated token-optimization purpose and conflicts with least-privilege operation.

The recommendation has no accompanying restrictions requiring a disposable sandbox, read-only tools, a narrowly scoped command allowlist, or an environment without secrets and production access. Consequently, users may apply it to agents with shell, filesystem, network, deployment, or credential-bearing tools.

This does not independently grant operating-system privileges beyond those already available to the agent. It does, however, remove a user-approval boundary and allows the agent to exercise its existing permissions without case-by-case confirmation.

Attack Path

1. A user follows the Skill's advice and starts or configures an agent with --no-ask-user or --allow-all.
2. The agent has access to sensitive tools, such as shell execution, filesystem writes, network requests, deployment APIs, or credential-enabled integrations.
3. The agent processes attacker-controlled repository content, external data containing prompt injection, or an erroneous generated instruction.
4. That content induces the agent to request a destructive, privileged, or externally visible action.
5. Because the confirmation or permission boundary has been disabled, the action executes without explicit user review.
6. The action affects resources accessible under the agent process's existing identity.

Impact Assessment

An attacker or ...[truncated 753 chars]

Remediation

View remediation

Remediation Suggestions

Remove the unconditional recommendation to use --no-ask-user or --allow-all.

Replace it with guidance that preserves explicit approval for sensitive operations while reducing unnecessary interaction safely:

• Use least-privilege tool policies and grant only capabilities required for the current task.
• Batch clearly defined, low-risk, read-only operations into one approval.
• Use narrow command and path allowlists rather than unrestricted permission flags.
• Require confirmation for shell execution, file writes, credential access, network requests, deployments, and destructive actions.
• Run autonomous workflows in disposable sandboxes with no production credentials, sensitive mounts, or unrestricted network access.
• Separate read-only analysis from mutation or deployment phases.
• Log all autonomous tool calls and retain an emergency termination mechanism.
• If non-interactive flags must be documented, include a prominent warning and restrict their use to isolated environments with explicitly bounded permissions.

A safer replacement would be:

markdown

- Reduce confirmation round-trips by batching pre-approved, read-only operations.
  Preserve confirmation for writes, command execution, network access, credential
  use, and deployments. Avoid unrestricted flags such as `--allow-all` except in
  disposable sandboxes with no secrets or production access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill recommends using --no-ask-user / --allow-all flags to reduce confirmation round-trips, which normalizes disabling interactive safety checks without warning about the risks. In an agentic environment, this can materially increase the chance of unauthorized file changes, command execution, or other irreversible actions occurring without user review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says the skill triggers on phrases like "token usage" and "cut costs," which are broad enough to appear in general conversation outside this skill's intended scope. The activation guidance also mixes explicit triggers with broad topical conditions, making it less clear when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

# Token Optimizer

Cut token usage without cutting quality. Every technique below is battle-tested in production Claude Code, OpenClaw, and agentic systems.

## The 3 Token Drains (fix these first)