Security audit

Docs Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its documentation-generator purpose, but it also ships an undisclosed local utility that can persistently store and log user-provided text.

Review this before installing. The documented generator is local and does not appear to exfiltrate data, but avoid invoking the bundled script.sh with secrets or confidential text because it can retain arguments on disk. Also review generated documents before committing or publishing them because they include hardcoded BytesAgain attribution.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

other

Note

Location: scripts/docs-generator.sh:94
Finding: Undisclosed Promotional Content Injected into Generated Documentation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:5
Finding: Undocumented Persistent Storage of Raw Command Arguments
Content: View full analysis
> "$DATA_DIR/history.log"; } cmd_run() { echo " Running: $1" _log "run" "${1:-}" } cmd_config() { echo " Config: $DATA_DIR/config.json" _log "config" "${1:-}" } cmd_status() { echo " Status: ready" _log "status" "${1:-}" } cmd_init() { echo " Initialized in $DATA_DIR" _log "init" "${1:-}" } cmd_list() { [ -f "$DB" ] && cat "$DB" || echo " (empty)" _log "list" "${1:-}" } cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" } cmd_remove() { echo " Removed: $1" _log "remove" "${1:-}" } cmd_search() { grep -i "$1" "$DB" 2>/dev/null || echo " Not found: $1" _log "search" "${1:-}" } cmd_export() { [ -f "$DB" ] && cat "$DB" || echo "No data" _log "export" "${1:-}" } cmd_info() { echo " Version: $VERSION | Data: $DATA_DIR" _log "info" "${1:-}" } ``` ### Technical Analysis The secondary utility creates a persistent data directory immediately at startup and writes command arguments into plaintext files: - `_log` stores the first argument supplied to most commands in `history.log`. - `cmd_add` stores every supplied argument in `data.log`. - The directory and files use permissions determined by the caller's current `umask`; the script does not enforce restrictive access. - No secret filtering, consent prompt, retention limit, cleanup command, or warning is provided. - The persistent storage behavior is not part of the documentation-generation functionality described in `SKILL.md`. If a user supplies an API token, credential, pr ...[truncated 2010 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is documentation generation, but the detected behavior reportedly performs persistent local storage, logging/history collection, and generic database-like add/list/search/export operations while lacking actual documentation-generation functionality. That is a strong deception signal: a user may authorize or run the skill expecting harmless doc creation while it instead accumulates data locally and enables collection/export of potentially sensitive content.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script's functionality materially contradicts the declared purpose of the skill: instead of generating documentation, it acts as a generic local logger/list manager with persistent storage. This kind of capability mismatch is dangerous because users or calling systems may grant trust, permissions, or workflow placement based on the advertised documentation role, while the script silently stores user-provided data and command history on disk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill advertises executable usage via a shell script and static analysis detected network-capable code, yet the manifest declares no permissions or allowed-tools scope. That lack of explicit tool scoping reduces transparency and weakens enforcement boundaries, making it easier for the skill to perform unexpected outbound actions if executed in an agent environment.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/docs-generator.sh (reported line 33)May include surrounding context.
sh
] print("## {} API".format(resource.capitalize())) print("") print("Base URL: `https://api.example.com/v1`") print("") print("### Endpoints") print("")

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The inline help and comments describe the tool as a 'multi-purpose utility tool,' directly conflicting with the skill metadata that presents it as a documentation generator. This inconsistency increases security risk because it obscures the true behavior of the asset, making review, approval, and least-privilege decisions less reliable.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script persistently writes entries to data.log and records command activity in history.log under a user-controlled data directory without clearly warning the user that inputs and actions are being retained. In a skill context, this is risky because user-supplied content may include sensitive project names, tokens, internal paths, or other confidential data that becomes locally stored unexpectedly.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.