Security audit

Arquitecto Senior

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently performs local architecture analysis on a project the user chooses, with optional report or diagram output and no hidden network, credential, persistence, or destructive behavior found.

Install this only if you are comfortable letting it inspect the project folder you point it at. Avoid running it on your home directory, filesystem root, or folders with unrelated secrets, and use explicit output paths only when you want a report or diagram written there.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill instructs the agent to read local reference files and run Python scripts against a project directory, which implies filesystem access capabilities, yet no permissions are explicitly declared. This mismatch is dangerous because it can cause the skill to operate with undeclared file read/write behavior, reducing transparency and weakening policy enforcement or user trust around what the skill is allowed to access.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The script writes output directly to a user-specified path via --save with no validation, overwrite protection, or safety prompt. If this tool is run with elevated privileges or inside automation, an attacker or mistaken user could overwrite arbitrary files accessible to the process, causing data loss or clobbering sensitive configuration.

Static analysis

No suspicious patterns detected.