Security audit

Palette

Security checks for vulnerabilities and agentic risk

Overview

This package should be reviewed because it advertises color-palette generation, but the bundled script does not implement those features and is mostly a local log/search/status utility.

Install only after review or correction. The artifact does not deliver the advertised palette functionality, and its local persistence behavior is underdisclosed; do not pass secrets, private prompts, customer names, or sensitive brand material to it unless the implementation is fixed and storage/export behavior is made explicit.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description claims the skill creates and manages color palettes using color theory algorithms. However, the code contains no color computation, palette generation, preview rendering, or brand/UI color system logic. For commands like create, random, complementary, analogous, triadic, preview, list, save, and config, it only appends timestamped records to per-command log files under ~/.palette. Additional implemented features are statistics, export to json/csv/txt, search across logs, recent entries, and status reporting. This is a material description-behavior mismatch because the primary implemented behavior is local activity logging and log management, not color palette functionality.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script's behavior materially differs from the stated palette-design purpose: instead of generating or managing color palettes, it records arbitrary user-provided arguments into persistent logs and offers generic data handling features. This kind of scope mismatch is dangerous because users may supply sensitive design notes, prompts, or tokens under the assumption they are being used for palette operations, while the skill silently stores them for later retrieval/export.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The help text claims functional palette operations such as create, random, complementary, analogous, and triadic, but the handlers mostly just append command names and arguments to log files. This deceptive behavior is dangerous because it can trick users into providing content to a tool that does not perform the advertised task and instead persists that content locally.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: palette version: "1.0.0" description: "Create and manage color palettes using color theory algorithms. Use when designing UIs or building brand color systems." author: BytesAgain homepage: https://bytesagain.com source: https://github.com/bytesagain/ai-skills

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The export function packages all stored logs into JSON, CSV, or text files, enabling bulk extraction of accumulated user inputs unrelated to legitimate palette generation. In a skill that does not need broad data export, this creates an unnecessary exfiltration-style capability and amplifies the impact of any sensitive data captured in the logs.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The search command provides a generic mechanism to enumerate and retrieve previously stored user inputs from local logs, which is not necessary for a color palette utility. In context, this increases the risk of exposing sensitive material a user may have passed as arguments, and broadens the skill from a design tool into a local data collection/query surface.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: These command handlers persist raw user-supplied arguments under ~/.palette without prior warning, minimization, or redaction. Because users may pass project names, prompts, brand details, or other sensitive content while expecting palette processing, silent retention creates a privacy and data exposure risk even without network transmission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly states that it stores palette data and configuration under the user's home directory and supports exporting to a caller-supplied output path, but it does not clearly warn that using the commands will write files to disk and may overwrite existing files. This can lead to unintended persistence of user-provided data and accidental file clobbering, especially in automation contexts where users may assume a read-only helper.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.