Security audit

README Env Table Sync

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small local README table generator whose file reads and optional README write are disclosed and aligned with its purpose, with a limited Markdown-rendering caveat.

Install only if you are comfortable with a local script reading an env template and, in apply mode, rewriting the selected README marker block. Use the default report mode first, keep ENV_FILE and README_FILE scoped to trusted project files, and review generated README diffs before committing, especially if env template values may come from untrusted contributors.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sync-readme-env-table.sh:63
Finding: Markdown Injection Through Insufficiently Escaped Environment Values
Content: View full analysis
Remediation: View remediation
` elements and HTML-escape all untrusted values with a standard encoder such as Python's `html.escape()`. 2. If Markdown inline-code spans must be retained, calculate a backtick delimiter longer than any consecutive backtick sequence in the value, and continue escaping table delimiters appropriately. 3. Normalize or reject control characters that could disrupt the generated table structure. 4. Add regression tests covering: - Single and repeated backticks - Markdown links and images - Raw HTML tags - Pipe characters - Newlines and carriage returns - Empty values 5. Run the generator against adversarial fixtures and verify that every value renders as literal code rather than active Markdown or HTML. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill performs file read and file write operations against paths supplied via environment variables, but its manifest does not declare any tool scope such as permissions or allowed-tools. This weakens policy enforcement and reviewability, because consumers cannot easily tell that the skill can modify repository files like README.md and could be repurposed to overwrite other files if invoked with attacker-controlled paths.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.