Security audit

size probe

Security checks for vulnerabilities and agentic risk

Overview

The skill does not show code execution or data theft, but it is mostly repeated filler content that is disproportionate and poorly scoped for its stated purpose.

Review before installing. The skill appears non-executable and does not request sensitive access, but its duplicated filler content and vague scope make it low-confidence as a useful skill and may consume unnecessary context when loaded.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (222)

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 92% confidence
Finding: The skill embeds a multipart/form-data style payload with a large block of repeated text, which appears to be padding rather than meaningful skill content. Excessive repeated content can inflate prompt size, waste context budget, and potentially degrade or disrupt downstream analysis or agent behavior, especially in systems that ingest skill files verbatim.
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
Content-Disposition: form-data; name="files"; filename="assets/f0.txt" Content-Type: text/plain Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This .txt file falls under the vague-trigger category, but it provides only broad descriptive phrases such as 'Occupational analysis data file' and 'professional construction support tool' without any explicit invocation phrases, scope boundaries, or exclusion conditions. That lack of trigger specificity can make it unclear when the skill should activate versus when it should not.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This .txt file falls under the vague-trigger rule scope, but its repeated description only states broad subject matter such as 'construction support tool' and 'typical work tasks' without specifying when the skill should activate, what exact phrases invoke it, or what contexts are excluded. That lack of trigger specificity can cause unintended matching against broad educational or occupational-analysis requests.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f1.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f10.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f100.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f101.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f102.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f103.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f104.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f105.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f106.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f107.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f108.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f109.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f11.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f110.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f111.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f112.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f113.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f114.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f115.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f116.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f117.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · assets/f118.txt (reported line 1)May include surrounding context.
text
Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains. Occupational analysis data file. Vocational education professional construction support tool. Work process systematization method. Typical work tasks, action domains, learning domains.

Static analysis

No suspicious patterns detected.