Security audit

Registration

Security checks for vulnerabilities and agentic risk

Overview

The skill appears local-only, but it does not match its advertised registration-management purpose and may persist sensitive attendee inputs in local logs.

Review this skill carefully before installing. It does not appear to exfiltrate data or alter system privileges, but it is not a complete registration manager and is designed to keep local activity records under ~/.local/share/registration. Avoid entering names, contact details, or other attendee information unless you are comfortable with that local retention and have a plan to secure or delete the stored files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill’s declared purpose is attendee/registration management, but the documented behavior is a generic local logging utility that stores arbitrary inputs and exposes search/history/statistics functions over those logs. This mismatch is dangerous because users may supply attendee or other sensitive data under false assumptions about purpose and scope, while the skill persists broader data locally without clearly scoped permissions or a defined registration data model.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script defines a dedicated _export routine, but the main case statement contains an earlier export branch that only logs arbitrary input, making the real export path unreachable. In a skill advertised to manage attendee data, this mismatch can cause users to believe data has been exported when it has instead been silently persisted to local logs, increasing the risk of unintended retention and disclosure of potentially sensitive registration information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description uses broad activation wording for a skill that appears to accept many generic inputs and log them persistently, making it easier for an agent or user to invoke it outside its legitimate scope. In context, this increases the chance that unrelated or sensitive information is routed into a local logging mechanism under the label of 'registration' work.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Although the file later mentions local storage, the introductory usage area does not warn users that attendee data and activity history are being persistently written to disk. For a skill handling potentially sensitive registration information, this omission can cause accidental collection and retention of personal data without informed user awareness.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes a registration-management skill for sign-ups, capacity checks, export conversion, and confirmation reporting. In practice, the implemented commands such as run, analyze, preview, batch, compare, config, and status just append free-form input to per-command log files without any registration-specific data model, attendee handling, capacity logic, or confirmation generation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Commands like analyze, preview, batch, compare, config, recent, and status are broad utility verbs with no registration-specific semantics in their implementations. Given the manifest's narrow purpose around registration records and attendee data, these generic capabilities are unjustified and expand the skill beyond its stated context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This script persistently records user-supplied input and activity history under ~/.local/share/registration without any upfront warning, consent flow, minimization, or redaction. Because the stated use case involves registration records and attendee data, users are likely to enter names, contact details, or other personal information, making silent local retention a meaningful privacy and security risk if the host is shared, backed up, or later compromised.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script similarly defines a _status function but shadows it with an earlier status branch that logs user input instead of showing health/status information, making the intended status behavior unreachable. In this context, users may paste operational or attendee details expecting a harmless status check, but the script persists that input to disk, creating avoidable exposure of sensitive registration data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.