Security audit

PhiProto CLI

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real PhiProto conversion helper, but it under-discloses that setup downloads and installs an external executable into the user's PATH.

Install only if you are comfortable trusting the external phicli GitHub release. Prefer manually downloading a pinned release, verifying a checksum or signature if available, and reviewing getphi.sh before allowing anything into $HOME/.local/bin. No artifact-backed exfiltration or destructive behavior was found, so this is Review rather than malicious.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill enables shell-command behavior but declares no permissions, which hides a meaningful capability from the runtime and from reviewers. In this context, the undocumented shell access is more dangerous because the skill also instructs use of an external binary and file-writing operations, increasing the chance of unexpected execution paths.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to inspect and convert PhiProto content using a bundled binary, but the documentation also directs the agent to download a binary from GitHub and perform installation/setup actions. That mismatch is dangerous because users and security controls may trust the skill as a local file-conversion tool while it actually introduces network retrieval and executable installation, which can lead to supply-chain compromise or unauthorized system modification.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The safety notes say the tool runs local-only, yet they also instruct downloading the binary from GitHub via a script. This contradiction can mislead users and automated systems into underestimating network and supply-chain risk, especially because a download script may change over time and fetch untrusted or altered content.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script downloads an executable from the internet at install time, which introduces a software supply chain risk and enables arbitrary code execution if the remote asset, release account, or transport path is compromised. This is more dangerous in context because the skill claims a bundled PhiProto tool for local inspection/conversion, but instead silently fetches a binary at runtime with no integrity verification.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill metadata says it uses a bundled phicli binary, but the script actually retrieves phicli from GitHub at runtime. This mismatch is security-relevant because it defeats user expectations, hides network-dependent behavior, and increases the chance of unreviewed code being introduced into the environment.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill documents writing output files with `-o` but does not warn about overwriting existing files or modifying user data. In a conversion skill that operates on user-supplied paths, silent file replacement or writes to unintended locations can cause data loss or facilitate abuse when paths are manipulated.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script writes a network-downloaded executable into $HOME/.local/bin, a common user PATH location, without any warning or consent. This can persistently alter the user's execution environment and enables remote code execution if the downloaded binary is malicious or later replaced upstream.

Static analysis

No suspicious patterns detected.