File Organizer

• Outcome: Pass
• Latest audit: Sep 23, 2026 · 7:01 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed, safety-focused file organizer that can inspect and propose changes to local files, but its instructions require read-only scanning first, explicit confirmation, backups, trash-only deletion, and small batches.

Install only if you want an agent to inspect and help organize local folders. Use it on specific directories, review every proposed move/rename/trash action, and confirm that backups and trash behavior are available before allowing changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The code is narrowly focused on read-only duplicate scanning and reporting. It hashes files, groups them by hash/name/size, skips symlinks and oversized files, and optionally writes a JSON report. This partially aligns with the declared description's 'find duplicates' and 'read-only first' aspects, but the declared purpose describes a much broader file-organization and cleanup skill with guarded modification workflows. Those broader capabilities are absent from the supplied code chunk. There is no evidence of organizing files, suggesting folder layouts, cleaning up, sorting photos by date, trashing files, creating backups, or requesting confirmations. Therefore the description materially overstates the implemented behavior of this code chunk.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger list includes broad phrases plus an open-ended "and similar requests" clause, which can cause the skill to activate for ambiguous file-management requests beyond the user's intent. In a skill that can eventually move, rename, or trash files, unintended invocation increases the chance of risky operations being proposed or initiated in the wrong context, even with read-only-first guardrails.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The Chinese trigger examples are generic file-cleanup phrases without clear boundaries, so the skill may activate on requests that are only loosely related to organization. Because this skill operates in a filesystem context, ambiguous activation can expose users to unintended scanning or follow-on action proposals against sensitive directories.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The module docstring says the script 'only reports' and 'NEVER deletes, moves, or renames anything,' and the CLI description repeats 'Read-only duplicate scanner.' However, when --json is provided, the script writes a file via Path.write_text at L151-L154. While this does not modify scanned files, it contradicts the strict read-only wording in the documentation.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The script's human-facing status and report strings switch to Chinese for key output sections, while the CLI does not offer any language selection or explain a required locale. This creates a natural-language policy issue because it imposes a specific language on users by default.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The skill manifest stresses 'read-only first' safety guardrails, and this file presents itself as a read-only duplicate scanner. Yet the --json option writes a report file to an arbitrary path. That write may be benign and user-directed, but it is still behavior beyond a strictly read-only scanner description.

Static analysis

No suspicious patterns detected.