Security audit

Ai Act Risk Check

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for AI Act screening, but it under-discloses the actual LLM dependency and privacy boundary for user-provided descriptions.

Review before installing. Treat the output only as a rough screening aid, do not use it as the sole basis for legal or compliance decisions, and avoid entering confidential or regulated details unless you are comfortable with them being processed by the Gemini CLI/provider configured in your environment.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: script.sh:12
Finding: Untrusted AI System Description Enables Prompt Injection
Content: View full analysis
Remediation: View remediation
LOW-RISK: General Purpose AI or Not Listed ``` 5. Reject unexpected prose, malformed category numbers, and additional output. 6. Where decisions have compliance consequences, corroborate model output with deterministic rules or mandatory human review. 7. Add adversarial tests covering descriptions that contain phrases such as “ignore previous instructions,” fabricated output formats, role markers, and embedded prompt delimiters. 8. Document that the result is preliminary and that the tool is not safe as the sole basis for a legal classification. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: script.sh:12
Finding: Incorrect Shell Escaping Corrupts the Constructed Prompt and Gemini Argument
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi PROMPT=$(cat < $SYSTEM_DESCRIPTION Return only a value matching the approved classification schema. EOF ) if ! RESULT=$(gemini -p "$PROMPT"); then printf '%s\n' "Error: Classification inference failed." >&2 exit 1 fi ``` Additional hardening should include: 1. Run `bash -n script.sh` in continuous integration. 2. Analyze the script with ShellCheck and resolve quoting warnings. 3. Check the exit status of `gemini` before displaying a result. 4. Verify that `gemini` exists with `command -v gemini`. 5. Add end-to-end tests containing spaces, quotes, backslashes, newlines, glob characters, and instruction-like input. 6. Reject empty or schema-invalid model responses instead of presenting them as valid classifications. ]]>

other

Note

Location: SKILL.md:14
Finding: Inference Dependency and Provider Are Incorrectly Documented
Content: View full analysis
Remediation: View remediation
/dev/null 2>&1; then printf '%s\n' "Error: the Gemini CLI is required but was not found." >&2 exit 127 fi ``` 7. Keep documentation, package metadata, and runtime behavior synchronized through an integration test. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documentation states it uses pure shell and oracle via exec for inference, but it does not clearly warn users that their supplied system descriptions are transmitted to an external LLM service. This creates a real privacy and data-governance risk because users may paste sensitive business, employment, infrastructure, or compliance details assuming local processing.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.