Security audit

skill-publish-sync

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent publishing helper, but its Lenovo batch uploader can publish many skills automatically with limited per-run control, so it should be reviewed before installation.

Install only if you intend to publish skills to these public platforms. Review and edit each allowlist first, avoid putting real tokens directly in reusable shell history, run preparation/dry-run checks before publishing, and do not run the Lenovo batch script unless you have verified the exact skill list and accept that it will upload/update remote content.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill describes capabilities that read environment-derived credentials and write stateful files such as sync records and temporary publish artifacts, but it does not declare permissions or boundaries for those actions. In an agent setting, undeclared file-write and credential-adjacent behavior reduces user visibility and can lead to unintended modification of local files or use of sensitive local auth material during publishing.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The documentation presents Lenovo publishing support as established functionality while later admitting key Lenovo CLI behaviors were not independently verified. That contradiction can cause operators to trust an unvalidated release path, potentially uploading incorrect package contents or mishandling metadata and credentials on a public platform.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The activation guidance is broad enough that an agent may invoke this skill for general publishing, status checking, or bulk sync tasks without narrow guardrails. In a skill that can publish publicly and modify local records, loose trigger boundaries increase the chance of accidental execution against the wrong skills or platforms.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation instructs users to pass API tokens directly on the command line without warning that shell history, process listings, logs, or copied transcripts may expose those secrets. Because this skill targets public-platform publishing, credential leakage could enable unauthorized publication or account takeover of the associated platform identity.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script uses `expect` to automatically answer interactive prompts and proceed with `push` to a remote external platform, which can publish or update skills without an explicit per-run warning or confirmation from the operator. In a batch publishing context, this increases the chance of accidental irreversible releases, especially because the script is designed to iterate over many skills and continue after failures.

Static analysis

No suspicious patterns detected.