Security audit

skill-builder

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed skill-building helper, with some broad activation and silent capability-check behavior users should understand before installing.

Install this only if you want an agent helper that can draft, edit, evaluate, and optionally install other skills. Review generated skills before confirming installation, and avoid putting sensitive business or personal wording into evaluation prompts if you do not want it saved in local eval files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Self-Modification

High

Category: Rogue Agent
Content: ## Two paths - **Light path (default) / 轻量路径（默认）** — capture intent → write SKILL.md → quick self-test → deliver. At most 2 clarifying questions, with sensible defaults stated up front - **Full path (optional) / 完整路径（可选）** — adds evaluation: real test prompts, with-skill vs. without-skill baseline comparison, benchmark reruns. Only for production-grade skills with objectively verifiable outputs ## Key features
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Vague Triggers

High

Confidence: 98% confidence
Finding: The description is intentionally broad and says to proactively use this skill even when the user does not explicitly mention skills, as long as they describe a repeatable workflow. Overbroad triggers can hijack ordinary conversations, causing this skill to activate in contexts where the user did not intend tool or file operations. Because this is a meta-skill that can create, modify, review, and potentially install other skills, accidental invocation has a larger blast radius than a narrow single-purpose skill.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The usage guidance explicitly says to invoke the skill even when the user does not mention 'skill' if the request resembles a repeatable workflow. That broadens activation scope enough to cause unintended triggering on ordinary requests, potentially routing sensitive or unrelated tasks into a meta-skill that creates or modifies agent behavior.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to silently probe host capabilities such as subagents, CLI, browser, scripts, and filesystem access before beginning work. That expands data collection and system discovery beyond what a generic skill-authoring workflow strictly needs, and doing it silently removes user awareness and consent. In a skill-building context this can normalize unnecessary reconnaissance that could later be reused by more dangerous skills.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill tells the agent to inspect host capabilities silently and to avoid reporting probe results unless they materially change user experience. Silent inspection of the runtime environment reduces transparency and prevents informed consent, especially where the checks may touch local tools, filesystem support, or browser availability. In security terms, this is covert environment reconnaissance embedded in normal workflow guidance.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: Telling the agent to independently research dependencies, best practices, and edge cases authorizes external information gathering beyond the manifest's core purpose of creating or reviewing skills. That can cause unbounded browsing or retrieval of external content without user expectation, potentially exposing conversation context or pulling in untrusted material. The danger is amplified because it frames such research as default behavior rather than an opt-in action.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Step 2: Fill in the SKILL.md / 填写 SKILL.md Based on the confirmed intent, write the skill. Follow the structure and writing rules in `references/skill-structure-guide.md`. Read it before writing. 按确认的需求写 skill。先读 `references/skill-structure-guide.md`，遵循其目录结构、渐进披露和写作风格规则。
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Step 2: Fill in the SKILL.md / 填写 SKILL.md Based on the confirmed intent, write the skill. Follow the structure and writing rules in `references/skill-structure-guide.md`. Read it before writing. 按确认的需求写 skill。先读 `references/skill-structure-guide.md`,遵循其目录结构、渐进披露和写作风格规则。
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The evaluation flow instructs saving realistic prompts, derived from user wording, into a local file without requiring a user-facing disclosure. Even if the prompts seem harmless, they may contain sensitive business processes, proprietary wording, or personal data from the conversation. Persisting them silently creates avoidable data retention and privacy risk.

Natural-Language Policy Violations

Medium

Confidence: 81% confidence
Finding: Line L53 says "ALWAYS use this exact template," and the template headings on L54-L57 are in English. This can be read as forcing English output structure regardless of user locale, and the file does not offer opt-in, alternatives, or a documented justification for the locale constraint.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The guide explicitly encourages writing descriptions to be 'pushy' and to trigger even when users do not explicitly request the skill. That creates a systematic incentive for over-broad activation, which can bypass normal user-intent boundaries and cause the agent to invoke capabilities the user did not ask for, increasing the chance of inappropriate actions, misleading workflow selection, or policy-noncompliant behavior at scale.

Vague Triggers

Low

Confidence: 89% confidence
Finding: The README states that the description field is the primary trigger mechanism and emphasizes anti-undertrigger wording, but it does not pair that with strict trigger boundaries. This encourages broad trigger phrasing, which can increase accidental activation frequency and cause the skill to overreach into adjacent tasks.

Natural-Language Policy Violations

Low

Confidence: 81% confidence
Finding: This markdown file is entirely presented in Chinese text with bilingual headings, but the actionable checklist items themselves are only in Chinese. Under the policy rule for natural-language constraints, this can be read as forcing a specific language without an explicit opt-in or justification for a region-specific audience.

Static analysis

No suspicious patterns detected.