Security audit

Source Library

Security checks for vulnerabilities and agentic risk

Overview

This skill is local and purpose-aligned, but it automatically saves every shared URL and related analysis persistently without per-link confirmation.

Install only if you want shared links to be treated as long-term local knowledge by default. Avoid sharing private, internal, or sensitive URLs while the skill is active unless you are comfortable with summaries and context being written under life/source; review and manually delete stored files when needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Vague Triggers

High

Confidence: 96% confidence
Finding: The skill is configured to auto-trigger on "ANY URL," which is overly broad for a capability that persistently stores and cross-references user-shared content. This can cause the agent to capture ordinary conversational links without explicit user intent, creating privacy and consent risks and unexpectedly expanding the user's stored knowledge base.

Ae1

High

Category: analysis-evasion
Content: 1. `node scripts/source-library.js setup` — creates directories
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: 1. `node scripts/source-library.js setup` — creates directories
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: 1. `node scripts/source-library.js setup` — creates directories
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: 1. `node scripts/source-library.js setup` — creates directories
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README emphasizes convenience and automatic capture but does not clearly warn users that shared URLs, summaries, claims, and analysis are stored persistently in the workspace. This creates a privacy and data-retention risk because users may share sensitive, internal, or personal links without realizing they will be indexed, cross-referenced, and retained over time.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The README describes very broad trigger conditions such as saving content when a user shares any URL, which can cause the skill to activate in situations the user did not clearly intend. Because this skill persistently stores and analyzes shared links and related content, accidental invocation can lead to unanticipated retention of sensitive research, private links, or contextual metadata.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill stores URLs, summaries, claims, quotes, analysis, and context persistently in local files, but the user-facing description does not clearly warn that this retention happens automatically. In a knowledge-management skill with broad URL-triggering, lack of transparent disclosure increases the chance users unknowingly persist sensitive links, notes, or contextual reasoning.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The queue done branch removes an item from source-queue.json by rewriting the queue without the selected entry. Although it logs after removal, there is no prior confirmation or warning that the operation is destructive and cannot be undone from within the tool.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: This code path bulk-imports JSON entries and persists them by calling saveSource, which creates directories and writes summary files under the workspace. While individual writes emit success logs, there is no clear upfront disclosure in this command that running import will create multiple files on disk, which is a safety-relevant side effect for a CLI tool.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/test.js:20