Security audit

Fzf

Security checks for vulnerabilities and agentic risk

Overview

This terminal productivity skill appears useful, but it asks agents to make persistent shell changes and provide disruptive process/Git/Docker actions without enough user control.

Review before installing. Only allow shell profile edits after seeing the exact lines to be added, make a backup of ~/.bashrc or ~/.zshrc, and treat process-kill, Git mutation, and Docker stop/log helpers as commands that should require deliberate confirmation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The guide explicitly instructs an AI to automatically add shell functions to the user's shell configuration file. Persistently modifying startup files without explicit confirmation is dangerous because it creates lasting system behavior changes, may overwrite user customizations, and can silently introduce commands that execute in future sessions.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill explicitly advertises process management with the ability to terminate processes, but it provides no warning, confirmation guidance, or safety constraints around destructive actions. In an agent context, this increases the risk that a user or automation flow could kill the wrong process and disrupt services, terminals, or other workloads.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill says the AI will automatically detect the environment, install fzf, configure shell integration, and write reusable functions into shell configuration files, but it does not warn that these actions modify the system and persistent user settings. In an agent setting, silent package installation or dotfile modification can create unintended changes, break shell startup, or violate least-astonishment and change-control expectations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guide explicitly tells an AI to automatically append shell initialization code to ~/.bashrc, which is a persistent user configuration change. Even though the command itself is standard fzf setup, silently modifying startup files can create lasting system-side effects, break user environments, or normalize unsafe autonomous edits without user consent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document instructs an AI to automatically modify ~/.zshrc, which is a persistent and security-sensitive shell configuration file. In an agent setting, this is risky because it grants the agent authority to change future shell behavior beyond the immediate task, and there is no explicit warning or approval gate for the user.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The guide includes `kill -9` examples that force-terminate whichever process the user selects, but it does not warn about the risks of abrupt termination such as data loss, corruption, or killing critical system/services. In an AI-assisted context, users may execute the command with limited understanding, making destructive misuse more likely.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document explicitly tells the AI to add configuration to `~/.bashrc` or `~/.zshrc`, which creates persistent modifications to the user's environment without a clear warning or confirmation step. Persistent shell changes can alter future command behavior, break workflows, or introduce hard-to-trace side effects if applied automatically by an agent.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Allowing an AI to change shell configuration automatically violates the principle of explicit consent for persistent environment changes. Because shell rc files affect future terminal behavior, even benign helper functions can create surprising execution paths, conflicts, or persistence opportunities if the content is later altered.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The AI guidance says Git-related functions may be integrated directly into shell configuration files without a clear warning or confirmation step. This is risky because these functions include state-changing Git operations such as checkout, add, stash pop, and stash drop, and making them persistent increases the chance of accidental invocation and repository damage.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The guide permits AI generation of Docker helper functions that can enter containers, stream logs, and stop containers without an explicit warning. In operational environments, these actions can disrupt services, expose sensitive data from logs, or alter running systems, so generating them for direct use without user acknowledgment is unsafe.

Static analysis

No suspicious patterns detected.