Second Read Editor

• Outcome: Pass
• Latest audit: Nov 2, 2026 · 6:10 AM UTC
• Version: 0.3.1

Overview

This editing skill keeps revisions under author control and clearly discloses its optional file searches and product checks.

Use a narrowly selected project folder and keep generated HTML private because it embeds the supplied draft and context. Enable command or network checks only after reviewing every command and destination; use a disposable checkout and temporary credentials as documented. Expect Canonical/US English documentation suggestions. All bundled files were inspected, including the scanner's partial-coverage areas; runtime behavior and host permission enforcement were not tested.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (5)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/knowledge_context.py (reported line 226)May include surrounding context.

python

score += 2
            signals.append("same_folder")
        name = Path(rel).stem.casefold().replace("-", " ").replace("_", " ")
        if any(token == name or token in name.split() for token in IMPORTANT):
            if Path(rel).parts[:1] == Path(key).parts[:1] or Path(rel).parent == Path("."):
                score += 4
                signals.append("potential_project_index_or_rules")

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Enforces US English for every documentation artifact without user opt-in.

Medium

• Category: Output Handling
• Confidence: 95% confidence

Finding

The instructions mandate Canonical's writing conventions for every documentation artifact and explicitly include US English. Calling this a product choice does not establish a locale-specific need or let authors preserve their chosen language or regional conventions.

Content

No source excerpt is available for this finding.

scripts/product_verify.py implements arbitrary command execution beyond the stated editorial scope (L112–L125).

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The manifest describes proofreading and resolving context from relevant files, permitted workspace tools, or official sources, but this branch executes any argv supplied by a claims manifest as a local program. The explicit --allow-exec gate reduces accidental execution, yet this general-purpose execution capability is neither declared nor an obvious requirement of editorial review; shell=False and a fixed working directory do not restrict what the program can access or modify.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/product_verify.py (reported line 123)May include surrounding context.

python

# No shell, fixed working directory and stdin closed. Execution remains
        # potentially consequential, so the opt-in is deliberately explicit.
        try:
            proc = subprocess.run(args, shell=False, cwd=root, stdin=subprocess.DEVNULL,
                                  capture_output=True, timeout=min(float(spec.get("timeout", 5)), 15),
                                  check=False)
        except (OSError, subprocess.TimeoutExpired) as ex: