37°C Soother

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:24 AM UTC
• Version: 1.0.0

Overview

This is a simple quote-generation skill with no code or privileged behavior, though its README should point to a verified install source instead of a placeholder GitHub URL.

This skill is appropriate for generating soothing quotes and short reflective copy. Before installing, use a verified repository or pinned commit instead of the README's placeholder URL, and expect that its broad trigger wording may make it appear in more writing contexts than necessary.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:23

Finding

Mutable Placeholder Repository Used as the Installation Source

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 23-26
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

text

## Installation

In Kimi Claw, enter:
Install this skill: https://github.com/yourname/37c-soother

Technical Analysis

The documented installation procedure directs users to retrieve the Skill from a GitHub repository containing the placeholder owner yourname. The source is not tied to a verified publisher, immutable commit, signed release, checksum, or other integrity control.

Because a repository reference normally resolves to mutable content, the files installed by a user could differ from the two files reviewed in this audit. An operator controlling the referenced namespace could replace the benign Skill instructions with malicious instructions or executable components after review.

The audited project itself does not contain code that automatically downloads or executes this repository. The vulnerability is therefore limited to the documented supply-chain installation path and depends on a user or installer following that instruction.

Attack Path

1. A user follows the installation command in README.md.
2. The installer resolves the mutable GitHub repository rather than a reviewed, immutable revision.
3. An attacker controls, compromises, or substitutes the referenced repository.
4. The attacker publishes altered Skill files, malicious instructions, or executable components.
5. The installer retrieves and loads that unaudited content.
6. The malicious content operates with whatever tools and permissions the hosting agent grants to installed Skills.

Impact Assessment

Successful exploitation could cause users to install content that was not included in the audited project. The resulting impact would depend on the capabilities granted by the host environment. It could include manipulation of agent behavior or, if an altered package introduced ...[truncated 451 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the placeholder URL with the verified canonical repository owned by the actual publisher.
2. Pin installation to an immutable commit hash or a cryptographically signed release rather than a mutable branch.
3. Publish a SHA-256 checksum or signed manifest for the reviewed package and require verification before installation.
4. Document the expected package contents so users can confirm that no unexpected scripts or configuration files were added.
5. Protect the source repository with multi-factor authentication, restricted release permissions, branch protection, and mandatory review.
6. Configure the installer to reject unresolved placeholders and warn users when a Skill is fetched from an unverified or mutable source.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises that it triggers on virtually any topic, emotion, or scene, making invocation criteria overly broad. This can cause the agent to select the skill in unintended contexts, leading to irrelevant or intrusive responses and increasing the chance that a generative skill overrides a more appropriate specialized skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.