Security audit

Speculative Exec

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but it encourages broad background preloading of local/context data on common user requests without clear scoping or user control.

Review before installing if your agent works around private repositories, credentials, logs, financial data, or conversation archives. Use it only where speculative preloading is acceptable, and prefer explicit user confirmation or local policy limits before allowing it to read files, indexes, configs, environment-related context, or history.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises behavior that pre-loads files, data sources, and conversation-derived context, and its examples invoke a Python script that can read local resources, but it declares no explicit tool scope or permissions boundaries. In an agent environment, that mismatch can enable unintended file access through broad or implicit invocation, reducing auditability and increasing the chance of over-collection of sensitive context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description emphasizes latency reduction but does not clearly disclose that it may pre-load files, data sources, search indexes, templates, or conversation history in the background. That lack of transparency is dangerous because users and downstream agents may not realize sensitive context is being accessed speculatively, creating privacy, consent, and least-privilege issues.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The invocation rules are triggered by very common verbs such as analyze, read, search, compare, and write, which makes accidental activation likely across many unrelated tasks. Because this skill performs speculative background loading, broad triggers can cause unnecessary access to files, indexes, templates, or history before the user has clearly requested those specific resources.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The file includes Chinese-language example input and bilingual trigger patterns, but does not explain whether the skill is language-agnostic, optimized for specific locales, or configurable by user preference. This can create an implicit language/locale assumption without clear opt-in or policy justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The workflow matcher embeds Chinese-specific trigger phrases across multiple patterns, which means the skill behavior is partially tailored to a specific language/locale by default. There is no surrounding user-facing mechanism to choose or opt into language handling, so this can conflict with a policy requiring language choice rather than implicit enforcement.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.