Security audit
Security checks for vulnerabilities and agentic risk
This skill is a low-impact reasoning workflow with disclosed local CLI and statistics files, with no evidence of data theft, destructive behavior, or privileged persistence.
Before installing, be aware that this skill can activate on broad analysis-style requests and may write a small local usage-statistics file. The /booster Python path is disclosed but should be clarified by the publisher, and the inspected booster.py currently has a syntax error that may affect functionality rather than security.
The documented behavior materially conflicts with the stated purpose: the skill claims to be only a self-contained reasoning framework with no endpoint or automation needs, but it also exposes Python-driven CLI/config/state functionality. This mismatch is dangerous because reviewers and users may trust the low-risk description while the skill actually performs operational actions and filesystem interactions.
The documented behavior materially conflicts with the stated purpose: the skill claims to be only a self-contained reasoning framework with no endpoint or automation needs, but it also exposes Python-driven CLI/config/state functionality. This mismatch is dangerous because reviewers and users may trust the low-risk description while the skill actually performs operational actions and filesystem interactions.
The documented behavior materially conflicts with the stated purpose: the skill claims to be only a self-contained reasoning framework with no endpoint or automation needs, but it also exposes Python-driven CLI/config/state functionality. This mismatch is dangerous because reviewers and users may trust the low-risk description while the skill actually performs operational actions and filesystem interactions.
The documented behavior materially conflicts with the stated purpose: the skill claims to be only a self-contained reasoning framework with no endpoint or automation needs, but it also exposes Python-driven CLI/config/state functionality. This mismatch is dangerous because reviewers and users may trust the low-risk description while the skill actually performs operational actions and filesystem interactions.
The documented behavior materially conflicts with the stated purpose: the skill claims to be only a self-contained reasoning framework with no endpoint or automation needs, but it also exposes Python-driven CLI/config/state functionality. This mismatch is dangerous because reviewers and users may trust the low-risk description while the skill actually performs operational actions and filesystem interactions.
The documented behavior materially conflicts with the stated purpose: the skill claims to be only a self-contained reasoning framework with no endpoint or automation needs, but it also exposes Python-driven CLI/config/state functionality. This mismatch is dangerous because reviewers and users may trust the low-risk description while the skill actually performs operational actions and filesystem interactions.
The documented behavior materially conflicts with the stated purpose: the skill claims to be only a self-contained reasoning framework with no endpoint or automation needs, but it also exposes Python-driven CLI/config/state functionality. This mismatch is dangerous because reviewers and users may trust the low-risk description while the skill actually performs operational actions and filesystem interactions.
Referenced artifact was not completely inspected
| `SKILL.md` | Skill definition + trigger conditions |
The documented natural-language triggers are broad phrases such as 'help me analyze', 'improve quality', and 'detailed analysis', which can easily appear in ordinary user requests. That creates unintended activation risk: the skill may alter model behavior or inject additional workflow steps when the user did not explicitly request this skill, which is a prompt-scope and control-boundary issue.
The skill declares no explicit tool scope, yet the documented /booster flow invokes Python modules that can read configuration and state files and may write usage/state data. Missing permission declarations weakens reviewability and containment, because users and the hosting framework cannot easily tell that filesystem access is part of the skill's behavior.
The skill says it is 'not an automation tool' and requires 'no Python calls needed', yet later instructs execution of a Python command for /booster handling. Self-contradictory documentation increases the chance that operators misunderstand what will execute, which undermines informed consent and security review.
The trigger conditions are extremely broad and match common phrases like 'detailed analysis' or many multi-step requests, which could cause the skill to activate unexpectedly. Overbroad auto-triggering is dangerous because it can silently alter agent behavior, invoke extra prompt files, or route users into an unintended workflow without clear consent.
Claiming 'no Python calls needed' while explicitly requiring a Python invocation for the /booster command is misleading about runtime behavior. Misleading execution semantics can cause users to trigger code paths they did not expect, especially in environments that treat skills as mostly declarative prompt assets.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
**LLM executes the framework itself, no Python calls needed:**
1. LLM reads `prompts/plan.md` → Create structured plan
2. LLM reads `prompts/draft.md` → Write complete draft
3. LLM reads `prompts/self_critique.md` → Review issues
4. LLM reads `prompts/refine.md` → Polish final output
The file’s user-facing and developer-facing natural-language text is consistently written in Cantonese/Traditional Chinese, including configuration and result model descriptions. This imposes a language choice without any indication of user opt-in or a documented locale-specific justification, which matches the language/locale policy violation criteria.
The module docstrings and user-facing usage text are written entirely in Traditional Chinese, including operational instructions and command descriptions. This creates a locale/language constraint without any indication that users may choose another language or that the restriction is justified for a region-specific skill.
The handler prints status text containing Chinese phrases such as "啟動" directly in user-visible output. This imposes a specific language on all users without any opt-in, selection mechanism, or justification that the skill is intended only for a Chinese-language context.
The completion and summary messages include Chinese text such as "完成", "步驟", and "耗時" in strings shown to the user. Under the policy, forcing a specific language in natural-language output is a violation unless the skill offers a language choice or clearly documents a justified locale restriction.
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
def build_orchestrator(depth: int) -> PipelineOrchestrator:
"""Build a PipelineOrchestrator with the given depth and mock dependencies."""
config = BoosterConfig(enabled=True, thinkingDepth=depth, maxRetries=0)
handler = SilentStreamHandler()
prompts_dir = os.path.join(os.path.dirname(__file__), "..", "prompts")
prompt_loader = PromptTemplateLoader(prompts_dir)
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
def build_orchestrator(depth: int) -> PipelineOrchestrator:
"""Build a PipelineOrchestrator with the given depth and mock dependencies."""
config = BoosterConfig(enabled=True, thinkingDepth=depth, maxRetries=0)
handler = SilentStreamHandler()
prompts_dir = os.path.join(os.path.dirname(__file__), "..", "prompts")
prompt_loader = PromptTemplateLoader(prompts_dir)
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
def build_orchestrator(depth: int) -> PipelineOrchestrator:
"""Build a PipelineOrchestrator with the given depth and mock dependencies."""
config = BoosterConfig(enabled=True, thinkingDepth=depth, maxRetries=0)
handler = SilentStreamHandler()
prompts_dir = os.path.join(os.path.dirname(__file__), "..", "prompts")
prompt_loader = PromptTemplateLoader(prompts_dir)
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
def build_orchestrator(depth: int) -> PipelineOrchestrator:
"""Build a PipelineOrchestrator with the given depth and mock dependencies."""
config = BoosterConfig(enabled=True, thinkingDepth=depth, maxRetries=0)
handler = SilentStreamHandler()
prompts_dir = os.path.join(os.path.dirname(__file__), "..", "prompts")
prompt_loader = PromptTemplateLoader(prompts_dir)
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
prompts_dir = os.path.join(os.path.dirname(__file__), "..", "prompts")
prompt_loader = PromptTemplateLoader(prompts_dir)
llm = MockLLM()
retry_handler = RetryHandler(max_retries=0)
step_executor = StepExecutor(llm, retry_handler, handler)
return PipelineOrchestrator(config, step_executor, prompt_loader, handler)
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
prompts_dir = os.path.join(os.path.dirname(__file__), "..", "prompts")
prompt_loader = PromptTemplateLoader(prompts_dir)
llm = MockLLM()
retry_handler = RetryHandler(max_retries=0)
step_executor = StepExecutor(llm, retry_handler, handler)
return PipelineOrchestrator(config, step_executor, prompt_loader, handler)
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
prompts_dir = os.path.join(os.path.dirname(__file__), "..", "prompts")
prompt_loader = PromptTemplateLoader(prompts_dir)
llm = MockLLM()
retry_handler = RetryHandler(max_retries=0)
step_executor = StepExecutor(llm, retry_handler, handler)
return PipelineOrchestrator(config, step_executor, prompt_loader, handler)
No suspicious patterns detected.