Security audit

test1

Security checks for vulnerabilities and agentic risk

Overview

This skill is a legitimate skill-building helper, but its bundled packaging and initialization scripts have real file-safety issues users should review before installing.

Install only if you are comfortable with a skill that can guide an agent to create, edit, delete generated examples, validate, and package local skill files. Use it only on trusted skill folders, avoid running the packager on directories from other people unless symlinks are checked first, and pass simple hyphen-case skill names with an explicit output directory. Review generated archives before sharing them.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/init_skill.py:189
Finding: Path Traversal Through an Unvalidated Skill Name
Content: View full analysis
Remediation: View remediation
64: raise ValueError("Skill name exceeds the maximum length") ``` 2. Explicitly reject absolute paths and path separators: ```python candidate = Path(skill_name) if candidate.is_absolute() or len(candidate.parts) != 1: raise ValueError("Skill name must be a single relative path component") ``` 3. Resolve the final path and verify that it remains beneath the authorized base directory: ```python base_dir = Path(path).resolve() skill_dir = (base_dir / skill_name).resolve() if not skill_dir.is_relative_to(base_dir): raise ValueError("Resolved skill path escapes the output directory") ``` 4. Run the process with the minimum filesystem permissions needed and avoid executing it as a privileged user. 5. Add regression tests covering `../target`, nested path components, absolute paths, repeated separators, leading or trailing hyphens, and valid skill names. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/package_skill.py:64
Finding: External File Disclosure Through Symlinks During Skill Packaging
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose suggests instructional or guidance behavior for authoring/updating skills. The actual code does not provide creation guidance, editing assistance, or workflow design support. Instead, it is an operational packaging script whose primary function is to validate a local skill directory and produce a distributable archive on disk. This is a materially different primary purpose and introduces undeclared filesystem/archive-writing capabilities not reflected in the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this is a guide for creating or updating skills, implying instructional or advisory behavior. The supplied code instead implements a quick validator that reads files from a provided directory, parses YAML frontmatter, and enforces specific formatting and schema constraints. That is a materially different primary purpose: automated validation tooling rather than guidance for skill creation. There is no evidence in the code of providing user-facing creation guidance, workflows, or tool-integration assistance as described.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: The skill explicitly instructs the agent to initialize a skill, edit resources, write SKILL.md, and package output, which is self-modifying behavior over local project content. In an adversarial or ambiguous context, this can lead the agent to create or alter executable scripts and instructions without tight constraints, potentially introducing unsafe code or modifying sensitive files in the workspace.
Content: Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.
md
1. Understand the skill with concrete examples 2. Plan reusable skill contents (scripts, references, assets) 3. Initialize the skill (run init_skill.py) 4. Edit the skill (implement resources and write SKILL.md) 5. Package the skill (run package_skill.py) 6. Iterate based on real usage

Self-Modification

High

Category: Rogue Agent
Confidence: 91% confidence
Finding: This section directs the agent to delete files it deems unnecessary and update SKILL.md, which is a form of autonomous repository modification. The dangerous aspect is not mere editing, but granting the agent discretion to remove and rewrite files in a development workspace, where mistakes or prompt manipulation could cause destructive changes.
Content: Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.
md
Any example files and directories not needed for the skill should be deleted. The initialization script creates example files in `scripts/`, `references/`, and `assets/` to demonstrate structure, but most skills won't need all of them. #### Update SKILL.md **Writing Guidelines:** Always use imperative/infinitive form.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · scripts/init_skill.py (reported line 266)May include surrounding context.
python
# Print next steps print(f"\n✅ Skill '{skill_name}' initialized successfully at {skill_dir}") print("\nNext steps:") print("1. Edit SKILL.md to complete the TODO items and update the description") print("2. Customize or delete the example files in scripts/, references/, and assets/") print("3. Run the validator when ready to check the skill structure")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 78% confidence
Finding: The skill instructs the agent to run local scripts, edit files, and package archives, which implies shell, file read, and file write capabilities, yet it declares no explicit tool scope or permission boundaries. In a skill that creates and modifies local resources, this omission increases the chance of overbroad execution and unintended access because the agent is not constrained to the minimum tools needed.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation condition is broad enough that the skill could trigger in many 'create or update a skill' contexts, including cases where the user did not intend filesystem changes or script execution. Overbroad triggering is more dangerous here because the skill recommends running scripts and modifying local files, which can escalate a simple advisory interaction into tool-using actions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.