Security audit

Survival Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it asks for broad autonomous access to files, browser state, messages, calendars, business accounts, and balance data without enough scoping or user control.

Install only if you are comfortable with an autonomous assistant periodically inspecting sensitive local and account-linked information. Before enabling it, narrow the allowed files, accounts, browser origins, APIs, and notification channels; require fresh approval before reading email/calendar/browser/business-account data or sending any data to models, search, APIs, or Telegram; and use a pinned reviewed package version.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:44
Finding: Overbroad Autonomous Access to Sensitive Resources
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: README.md:25
Finding: Unpinned Third-Party Installation Sources
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly claims that all file writes require user authorization, but the included PowerShell examples write to finance logs, authorization-pending.md, and survival-config.json directly with no authorization enforcement. This creates a trust-boundary mismatch: an operator may rely on the documentation for safety while the actual workflow permits silent state changes and file modification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README presents all operational instructions, examples, safety notes, and approval responses exclusively in Chinese, including the expected authorization reply terms like "批准" and "拒绝". This can constitute a language/locale policy violation because it implicitly forces a specific language for use without documenting an opt-in or stating that the skill is region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Most operational instructions, outputs, and user-facing authorization/status formats are specified in Chinese, including required response phrases like "批准" and "拒绝". The document does not state that language is configurable or optional, which can violate a language/locale policy requiring user choice unless the locale restriction is documented and justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad enough to cause the skill to activate on many routine events such as balance changes, record updates, or vague coordination needs. In an autonomous or semi-autonomous agent, ambiguous triggers increase the chance of unintended execution chains, including repeated checks, unsolicited actions, or cascading authorization requests.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.