Security audit

linuxdo-application

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only skill, but it is built to make AI-assisted account applications look self-written and more likely to pass a community review.

Review before installing. The skill is text-only and shows no malware-like behavior, but it is designed to optimize and disguise AI-assisted registration text for an access-controlled community. Users should only provide truthful, minimal personal details, should not fabricate background or intent, and should consider whether using AI assistance violates the community's registration expectations.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instruction to always run openskills list expands the skill's scope beyond drafting a registration application and can cause the agent to enumerate and load additional skills that were not necessary for the user's request. That increases attack surface, creates opportunities for prompt injection or unsafe capability chaining, and may expose unrelated tool metadata or behaviors.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README says the agent will conduct an adaptive survey and generate a registration application, but it does not warn users that they may be asked to disclose personal background details for account creation. In a skill specifically designed to craft high-pass-rate applications, this omission increases the chance that users will share sensitive personal information without informed consent or data-minimization guidance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is explicitly designed to produce 'high-pass-rate' and 'de-AI'd' registration applications, which signals an intent to help users evade authenticity or AI-content screening. Omitting a warning hides that the tool is facilitating circumvention of platform review controls and may mislead users about policy, fraud, or account-integrity risks.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill's stated purpose is to collect personal background details and convert them into a 'high-pass-rate' application optimized to appear human-written and compliant. This is dangerous because it operationalizes social-engineering against a community's registration gatekeeping, helping users bypass authenticity heuristics and undermining trust in the approval process.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The phased workflow systematically elicits background, discovery path, motives, and intended use, then applies a 'de-AI polish' and smell-test process specifically to make the final text look authentically human. In context, this is not normal editing assistance; it is a repeatable procedure for evading reviewer suspicion and increasing acceptance probability in an access-controlled community.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.