T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/healthcheck.md:22- Finding
Overbroad Access to Platform Configuration and Session Logs
- Content
View full analysis
- Remediation
View remediation
Security audit
Skeall Skill Builder
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent skill-building and auditing helper, but its health check mode can read sensitive agent configuration/session data and make network requests to URLs from audited skills.
Review this before installing if you use sensitive agent configs, private skill repositories, or local/session logs. Prefer `/skeall --scan <path>` for untrusted skills, avoid `--healthcheck-all` unless you are comfortable with broad local inspection, and do not run active URL validation against untrusted artifacts without first reviewing the destination list.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/healthcheck.md:170- Finding
Unrestricted URL Validation Permits SSRF-Like Network Probing
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to generate and modify
SKILL.mdcontent, which is a self-modification / prompt-construction capability. In an adversarial setting, a skill that rewrites agent instructions can propagate unsafe patterns, preserve malicious directives, or introduce persistence mechanisms into downstream skills unless strong validation boundaries are enforced.- Content
└── README.md # GitHub-facing (optional)
text 3. Write SKILL.md following these rules: - YAML frontmatter with `name` and `description` (see Frontmatter section) - Body under 500 lines, under 5000 tokens - Instruction-based framing, not persona-based
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md When files move to references/, links break silently. Markdown renderers don't warn about dead links.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ### 28. Silent skill deactivation from name/directory mismatch The `name` field in SKILL.md frontmatter does not match the parent directory name. The platform cannot locate the skill by name, so it silently ignores it. The skill appears installed but never activates — no error, no warning. Found in 3 of 22 production skills audited. This is the sneakiest bug in the list.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md 1. Collect all skill registry files: - `~/.openclaw/openclaw.json` (OpenClaw) - `~/.claude/settings.json` and `~/.claude/settings.local.json` (Claude Code) - `~/.agents/config.json` (OpenAI Codex) - Project-level `.claude/settings.json` in current directory 2. Search for any reference to the skill's `name` field in those files.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md 1. Collect all skill registry files: - `~/.openclaw/openclaw.json` (OpenClaw) - `~/.claude/settings.json` and `~/.claude/settings.local.json` (Claude Code) - `~/.agents/config.json` (OpenAI Codex) - Project-level `.claude/settings.json` in current directory 2. Search for any reference to the skill's `name` field in those files.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md 1. Collect all skill registry files: - `~/.openclaw/openclaw.json` (OpenClaw) - `~/.claude/settings.json` and `~/.claude/settings.local.json` (Claude Code) - `~/.agents/config.json` (OpenAI Codex) - Project-level `.claude/settings.json` in current directory 2. Search for any reference to the skill's `name` field in those files.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md name: skeall description: | Agent Skills (SKILL.md) builder, auditor, and improver for cross-platform LLM agents. Use for "skeall", "build a skill", "create skill", "improve skill", "audit skill", "skill review", or any SKILL.md question. Follows agentskills.io standard. ---
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The frontmatter description uses very broad trigger phrases such as "create skill," "improve skill," and especially "any SKILL.md question," which can cause the skill to activate for a wide range of unrelated requests. Overbroad activation increases the chance that this skill is loaded unnecessarily, exposing users to unintended instruction influence and creating routing conflicts with other skills.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md /skeall --improve <path> # Analyze and improve existing skill /skeall --scan <path> # Audit only, no changes (report) /skeall --scan . # Audit skill in current directory /skeall --scan-all # Batch scan all skills in ~/.claude/skills/ /skeall --scan-all <dir> # Batch scan all skills in custom directory /skeall --healthcheck <path> # Runtime check single skill (orphans, deps, env, URLs) /skeall --healthcheck-all # Runtime check all skills in ~/.openclaw/skills/
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
text [FAIL] R2 HIGH -- Duplicate name "reprompter" found in 2 locations: 1. ~/.openclaw/skills/reprompter/SKILL.md (modified: 2 weeks ago) 2. ~/clawd/skills/reprompter/SKILL.md (modified: today) Action: remove duplicate, symlink if needed
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
text [FAIL] R2 HIGH -- Duplicate name "reprompter" found in 2 locations: 1. ~/.openclaw/skills/reprompter/SKILL.md (modified: 2 weeks ago) 2. ~/clawd/skills/reprompter/SKILL.md (modified: today) Action: remove duplicate, symlink if needed
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
text [FAIL] R2 HIGH -- Duplicate name "reprompter" found in 2 locations: 1. ~/.openclaw/skills/reprompter/SKILL.md (modified: 2 weeks ago) 2. ~/clawd/skills/reprompter/SKILL.md (modified: today) Action: remove duplicate, symlink if needed
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
text [FAIL] R2 HIGH -- Duplicate name "reprompter" found in 2 locations: 1. ~/.openclaw/skills/reprompter/SKILL.md (modified: 2 weeks ago) 2. ~/clawd/skills/reprompter/SKILL.md (modified: today) Action: remove duplicate, symlink if needed
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # In SKILL.md: curl -X POST https://api.home-proxy.internal/v1/lights # Returned: Connection refused (proxy was shut down 3 months ago) # Static scan: PASS. Health check R5: FAIL.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Output
text [WARN] R5 MEDIUM -- Stale endpoint: https://api.example.com/v1 returned 404 Found in: SKILL.md line 82 (curl -X GET https://api.example.com/v1/status) Response: HTTP 404 (checked at 2026-02-19 02:00 UTC) Action: update URL or remove the curl command
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Output
text [WARN] R5 MEDIUM -- Stale endpoint: https://api.example.com/v1 returned 404 Found in: SKILL.md line 82 (curl -X GET https://api.example.com/v1/status) Response: HTTP 404 (checked at 2026-02-19 02:00 UTC) Action: update URL or remove the curl command
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Output
text [WARN] R5 MEDIUM -- Stale endpoint: https://api.example.com/v1 returned 404 Found in: SKILL.md line 82 (curl -X GET https://api.example.com/v1/status) Response: HTTP 404 (checked at 2026-02-19 02:00 UTC) Action: update URL or remove the curl command
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # In SKILL.md: curl -H "Authorization: Bearer $SUNO_API_KEY" https://api.suno.ai/v1/generate curl -H "X-API-Key: $SPOTIFY_CLIENT_SECRET" https://api.spotify.com/v1/me
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # In SKILL.md: curl -H "Authorization: Bearer $SUNO_API_KEY" https://api.suno.ai/v1/generate curl -H "X-API-Key: $SPOTIFY_CLIENT_SECRET" https://api.spotify.com/v1/me$SUNO_API_KEYwas set.$SPOTIFY_CLIENT_SECRETwas not — the Spotify integration was planned but never configured. The skill would fail silently at runtime for any Spotify command.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The template instructs authors to write 'Use this skill for any {trigger-1}, {trigger-2}, or {trigger-3} question,' but provides no requirement that those triggers be specific or bounded. Because this is a reusable template, it may lead authors to choose vague everyday-language triggers that cause unintended invocation overlap.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown uses "help me with X" as a natural-language trigger example. Even with the placeholder X, this phrasing is very close to ordinary user language and could encourage skills to activate on broad, everyday requests rather than narrowly scoped invocations.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md | Partial match | Related but not exact keyword | Skill may or may not activate | | Negative | Completely unrelated prompt | Skill does NOT activate | Write 3-5 trigger test prompts per skill. Include at least one negative test. ### Functional testing
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown reference uses Turkish trigger phrases and keywords such as "müzik çal", "araştır", and "web'de araştır" as normative examples for trigger-collision behavior, but it does not indicate that the skill is region-specific or that language choice is optional. That can conflict with organizational language/locale policy when users or skills are expected to support language choice rather than implicitly force one locale.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/anti-patterns.md:414