Skill Audit Framework

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:23 AM UTC
• Version: 1.2.0

Overview

This is a prompt-only audit checklist skill with no executable code, credential requests, or hidden system changes.

This skill is reasonable to install if you want an agent to follow a structured checklist before installing other skills. Expect it to read and summarize skill files during audits, and treat its PASS/WARN/FAIL output as guidance rather than a guarantee of safety.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

### 6. Dependency & Supply Chain
- [ ] Dependencies are well-known packages (not obscure single-author libs)
- [ ] No `curl | bash` or `curl | python` install patterns
- [ ] No post-install scripts that download additional code
- [ ] Package versions are pinned (not `latest`)
- **FAIL if**: Unknown dependencies, pipe-to-shell installs, unpinned versions

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

### 6. Dependency & Supply Chain
- [ ] Dependencies are well-known packages (not obscure single-author libs)
- [ ] No `curl | bash` or `curl | python` install patterns
- [ ] No post-install scripts that download additional code
- [ ] Package versions are pinned (not `latest`)
- **FAIL if**: Unknown dependencies, pipe-to-shell installs, unpinned versions

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger example "I want to install [skill]. Is it safe?" is broad natural language that could match many ordinary safety questions, without clearly constraining activation to this specific audit framework. The file does not provide negative examples or tighter invocation boundaries to distinguish when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

- [ ] No credentials unrelated to the skill's purpose
- [ ] File access limited to workspace directory
- [ ] No requests for system-wide permissions
- **FAIL if**: Requests credentials beyond stated purpose, accesses files outside workspace

### 3. Behavior vs Description Match
- [ ] Every file in the skill serves the stated purpose

Static analysis

No suspicious patterns detected.