Security audit

Ultimate Skills Finder

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate skill-discovery helper, but it needs review because it can read local skill data, contact multiple external services, share searched URLs with an outside scanner, and guide installs without clearly bounded disclosure.

Install only if you are comfortable with a discovery tool reading local skill metadata and sending your search terms or selected skill URLs to outside services. Avoid searching private project names or internal repositories unless the tool offers a local-only or allowlisted mode, and review any generated install command before running it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill documentation instructs use of file reads, network access, and shell execution, but the manifest does not declare any permissions or safety boundaries. This creates a transparency and consent problem: a user or orchestrator may treat the skill as low-risk discovery logic when it can actually inspect local files, reach external services, and run commands.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The documented purpose is remote skill discovery and comparison, but the behavior reportedly also indexes locally installed skills from user directories. Accessing local skill directories without clearly disclosing it expands data exposure and trust assumptions, especially because local skills may contain proprietary code, tokens, or internal tooling metadata.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The skill is presented as a finder/comparator, but it instructs the agent to proceed into installation actions, including package-manager and git-based commands. That broadens the operational scope from information retrieval to system modification, increasing the chance of unintended installs or execution of untrusted third-party code.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The installation examples include commands that change the user's environment, but there is no explicit warning about filesystem changes, package installation, or the risks of fetching third-party code. In an agent setting, omission of impact warnings can lead users to authorize commands without understanding the system consequences.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: User search queries are sent to multiple external services, and selected result URLs may also be fetched, without clear user-facing disclosure. In a skill-discovery context, queries can contain sensitive internal project names, planned capabilities, or other proprietary intent signals, creating an avoidable privacy leak to third parties.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The optional scan feature POSTs skill URLs to Gen Digital's external API without prominent disclosure about third-party data sharing. Even if only URLs are sent, those URLs can reveal what tools a user is evaluating or using, which may expose operational intent, internal repos, or sensitive workflows in an enterprise setting.

Static analysis

No suspicious patterns detected.