skill-builder

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:12 AM UTC
• Version: 1.0.0

Overview

This is a disclosed skill-building assistant with local validation/demo scripts; its file access and optional docs freshness check fit its stated purpose.

Install it per project unless you intentionally want it available globally. Expect it to read local project guidance and existing skills, generate or modify skill files when asked, and run its validator; review the proposed SKILL.md, tool grants, and any shell/dynamic-injection lines before saving or installing generated skills.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a skill-construction or migration assistant for agent skills: it should analyze plain-language descriptions and determine invocation mode, arguments, context cost, and scaffold/validate/test a skill. The supplied code does none of that. Instead, it performs documentation/spec freshness validation for a frontmatter reference file, including reading a local markdown snapshot, checking whether it is older than 90 days, optionally fetching a live documentation page over the network, and comparing documented field names. This is a materially different primary purpose and includes capabilities and resource access (local reference file plus network docs fetch) unrelated to the declared skill behavior. Therefore this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose describes an active skill-authoring tool that analyzes a plain-language description and scaffolds/reviews/migrates a skill, including decisions about invocation control, arguments, and context budget, plus validation/testing. The supplied code does none of that. It is a static Python data file defining frames for a demo GIF/terminal recording illustrating validator behavior. While the demo references validation conceptually, this chunk itself is not implementing the declared skill-building workflow and has a materially different primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose describes a meta-skill engineering utility for creating or reviewing agent skills from natural-language descriptions. The actual code chunk does not implement any of those functions. It contains image rendering logic: terminal frame layout, typing animation timing, text wrapping, palette quantization, and GIF file generation. Its primary purpose is media/demo generation, not skill construction, validation, migration, or invocation-policy selection. There are no visible behaviors related to agent-skill argument handling, disable-model-invocation decisions, testing generated skills, or similar functionality. This is therefore a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/claude-code-frontmatter.md (reported line 55)May include surrounding context.

md

The skill listing has a context budget (~1% of the context window; least-used skills lose their descriptions first when it overflows). `/doctor` estimates the listing's cost. `skillOverrides` in settings can force a skill to `name-only` or `off` without editing its file.

## Lifecycle notes that change how you write skills

- Once invoked, the rendered body stays in context for the rest of the session and is not re-read — write **standing instructions**, not one-time steps. Re-invocation with identical content is deduped (v2.1.202+).
- After auto-compaction, each invoked skill is re-attached with its first 5,000 tokens, under a 25,000-token shared budget, most-recent first — huge skills lose their tails; re-invoke after compaction if a skill matters.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/validate_skill.py (reported line 32)May include surrounding context.

python

(r"\bgit push\b", "git push"),
    (r"\bgh (pr|issue|release) (create|merge|close|edit)\b", "gh mutation"),
    (r"\brm -rf?\b", "rm -r"),
    (r"\bgit reset --hard\b", "git reset --hard"),
    (r"\bcurl\b[^\n]*-X *(POST|PUT|DELETE|PATCH)", "mutating HTTP call"),
    (r"\bnpm publish\b|\bcargo publish\b|\btwine upload\b", "package publish"),
]

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

md

---

Most skill generators fail the same three ways: they don't know the current frontmatter spec (`arguments`, `argument-hint`), they never suggest `disable-model-invocation`, and they write bloated descriptions that tax every session's context. This one treats those as the design decisions, and it's built to stay current: the spec knowledge lives in a pinned, dated snapshot that CI re-checks against the live docs weekly.

## What it does

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

Install

bash

mkdir -p your-project/.claude/skills
cp -r agent-skill-builder your-project/.claude/skills/agent-skill-builder

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file explains that !`command` and ```! blocks run before Claude sees the skill and are replaced by command output, which is effectively subprocess execution. Because this behavior can execute shell commands with side effects, the description should include a clear caution about safety, trust, and potential system impact.

Content

No source excerpt is available for this finding.