Security audit

Skill Discoverer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent marketplace-discovery assistant, but it needs review because it automatically stores chat routing data and can read personal work context, schedule recurring messages, and persistently change agent behavior.

Install only if you are comfortable with a skill that can read USER.md and recent memory, save chat routing identifiers, create recurring scan jobs, install other skills through skillhub, and write lasting agent rules after approval. Prefer manual scans, review every proposed MEMORY.md/SOUL.md/cron change, avoid broad full scans, and disable or delete stored config/logs if you do not want scheduled digests.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill attempts to establish itself as the preferred gateway for broad classes of future skill-installation requests, expanding its influence from discovery into agent routing and policy. That kind of self-preference can distort user intent handling, suppress alternative safer flows, and create an unauthorized persistence mechanism for future decisions.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill claims actions require user confirmation, yet it silently extracts and persists session metadata such as channel and chat_id on first run. Storing outbound messaging identifiers without prior consent creates a privacy and abuse risk, especially because those identifiers are then reused for scheduled push messages.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill goes beyond discovery and recommendation by asking to write durable behavioral rules into MEMORY.md, thereby modifying future agent behavior and installation policy. Persistent self-expansion is dangerous because it can reshape the agent's control priorities long after the original task, potentially overriding user expectations and enabling broader indirect prompt injection effects.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The document explicitly includes an installation command ('通过 skillhub 安装 {skill名称}') even though the skill metadata says all operations must require user confirmation. This creates a clear path for downstream automation or prompt chaining to perform installation without an explicit approval gate, which is especially risky because installing skills can change agent behavior or add new capabilities.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: Allowing '查所有'/'全量扫描' to lift limits broadens the scope from constrained discovery into effectively unrestricted marketplace enumeration. That increases resource use and exposure to untrusted content, and can undermine the manifest's stated intent of controlled recommendation and discovery behavior.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The fallback to a community-operated external API introduces undisclosed network egress and reliance on a different trust boundary than the manifest describes. Search terms may be sent to a third party, results may be less trustworthy, and this can bypass user expectations about where data is processed.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The instructions direct the skill to read USER.md and recent memory to derive business tags, which expands data access beyond simple skill discovery into profile and activity inspection. Even if intended for personalization, this can expose sensitive context unnecessarily and creates privacy and data-minimization concerns.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list is broad and includes common conversational phrases like asking whether there are any new skills, which can cause the skill to activate unintentionally in unrelated contexts. Because this skill can read USER.md and recent memory files, perform marketplace scans, and set up scheduled tasks, accidental invocation increases the chance of unnecessary data access, spammy automation, or user-confusing behavior.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Very broad triggers like generic scheduling phrases can cause accidental activation during ordinary conversation, causing the skill to inspect files, recommend installs, or prompt for cron creation when the user did not intend to invoke it. In a skill that can persist data and schedule recurring actions, overbroad activation increases the chance of unintended state changes.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The manual activation rule accepts 'other similar phrasing' without boundaries, which makes invocation ambiguous and prone to false matches. Because the skill performs sensitive follow-on actions such as reading memory, recommending installs, and proposing persistent scheduling, fuzzy activation materially raises misuse risk.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: Using broad phrases like '查所有' or '全量扫描' increases the chance that ordinary conversation triggers unusually expansive behavior. In a discovery skill that can fetch large volumes of untrusted marketplace content, accidental invocation can lead to unnecessary exposure, cost, and follow-on risky actions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The file describes reading user profile and recent memory for filtering without a clear privacy notice or consent boundary. Because those sources may contain sensitive organizational or behavioral data, silent use for recommendation can violate user expectations and increase the blast radius of prompt-driven access.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The fallback curl command sends the user's search term to an external service without prominently warning about third-party disclosure. That is a privacy and trust issue, and in some environments search terms may reveal internal projects, tooling interests, or business context.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to persist and later reuse channel and user identifiers from message metadata for outbound notifications. This creates a durable messaging capability tied to personal/session identifiers, increasing privacy exposure and enabling unwanted or misdirected notifications if the file is reused, copied, or tampered with.

Ssd 3

Medium

Confidence: 90% confidence
Finding: Mining USER.md and recent memory files to infer job role, projects, and active work expands the skill's access to potentially sensitive personal and business context. Even if used for recommendation, this broad background profiling can expose more data than necessary and increases the blast radius if logs, prompts, or downstream skills mishandle the extracted content.

Ssd 3

Low

Confidence: 76% confidence
Finding: The skill stores scan logs containing recommendation details and user decisions over time, creating a persistent activity trail. While lower risk than identifier harvesting, these logs can still reveal interests, workflows, and past choices if accessed by other skills, users, or processes.

Static analysis

No suspicious patterns detected.