Security audit

CGArtLab Quill

Security checks for vulnerabilities and agentic risk

Overview

Quill requires searching past writing and saving a profile of your values and preferences without first asking you to approve that access or retention.

Before installing, restrict historical reading to articles and folders you choose, and make personal profiling and profile saving optional. Review conversation links before sharing, keep private configuration files outside scope, and back up drafts because the preservation tests are unreliable.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · docs/research/skill-ci-continuous-improvement.md (reported line 46)May include surrounding context.
min-score: "80" # 每个 skill 0-100 分，低于阈值就红

text
它查的东西值得直接抄：frontmatter 合规、`references/` `templates/` `scripts/` `assets/` 里**被引用但不存在**的路径、`rm -rf` / `curl | bash` 这类危险命令、没有审批闸门的副作用指令。还能生成 badge。 **[letsloose501/sqs-skills](https://github.com/letsloose501/sqs-skills)** 把它推得更远：101 条编码规则，每条规则都有一个测试用例在盯着它（"each one watched firing on a test case"），CI 里有一条专门的 job 叫 **"no rule left unobserved"**。它还有两个别处没见的自律：

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env.

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

The workflow builds and persists a personal author profile from historical writing without first warning the user.

Medium

Category: Output Handling
Confidence: 88% confidence
Finding: The mandatory preliminary workflow reads ten historical articles, recursively searches for prior profiles, and persists inferred values and preferences without first obtaining informed permission. Although relevant to writing personalization, this can expose unrelated historical material to the agent and create an unexpectedly sensitive local profile; local project storage and the absence of an external transmission instruction limit the demonstrated impact.
Content: No source excerpt is available for this finding.

The unchanged assertion reports protected files as unchanged even when they have been deleted.

Medium

Category: Excessive Agency
Confidence: 99% confidence
Finding: The unchanged assertion iterates only over matching files present in the post-run workspace, so deleted protected files are never compared against the snapshot. Deleting some or all protected drafts can therefore yield a passing result, undermining the writing skill's explicit user-draft preservation guarantee and allowing destructive behavior to escape CI detection.
Content: No source excerpt is available for this finding.

The recommended publication disclosure includes a conversation link without warning about exposing private chat content.

Medium

Category: Output Handling
Confidence: 91% confidence
Finding: The recommended public disclosure template includes a conversation link without requiring a privacy review or explaining that sharing may expose unpublished drafts, personal information, or confidential source material. This is particularly relevant to a long-form writing skill, whose conversations may contain sensitive background information; however, the file does not itself create a share link or automatically publish chat contents.
Content: No source excerpt is available for this finding.

The publication disclosure template includes an AI conversation link without warning about exposing private conversation content.

Medium

Category: Output Handling
Confidence: 90% confidence
Finding: The recommended public disclosure template includes an AI conversation link without requiring consent or review for sensitive content. In this publication-focused skill, following the template could expose private prompts, unpublished drafts, personal information, or confidential research to readers, although the file itself neither creates nor publishes a link automatically. The surrounding guidance says disclosure requires the tool, purpose, usage, and scope, so sharing the underlying conversation is unnecessary.
Content: No source excerpt is available for this finding.

The documented writing workflow probes harness configuration and CC Switch databases outside the article workspace.

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The documented activation workflow directs the agent to inspect environment variables, harness configuration, and potentially ~/.cc-switch/cc-switch.db or settings.json outside the article workspace. These sources may contain credentials, provider configuration, or unrelated private data, creating unnecessary exposure to the model and possible inclusion in generated writing or logs. Conditional probing only when technically needed reduces the risk, but does not establish user authorization or limit which fields may be read; no deliberate exfiltration is shown.
Content: No source excerpt is available for this finding.

The workflow requires full AI authorship despite documentation limiting AI to consistency and fact checking.

Low

Category: Excessive Agency
Confidence: 98% confidence
Finding: L016 explicitly states that AI only performs consistency and fact checking. In contrast, L152 instructs the agent to compose a complete article in ai-draft.md, and L154 requires matching the author's voice. Retaining human approval and leaving the user's draft untouched do not resolve this contradiction about the AI's role.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: evals/run.mjs:78