Security audit

ontario-immigration-expert

Security checks for vulnerabilities and agentic risk

Overview

This immigration-scoring skill has a real purpose, but it mixes promises of live official policy with offline snapshot-based scoring and inconsistent network disclosures.

Review before installing or relying on it. Treat the scorer as a local reference calculator unless the agent has freshly checked the cited official Ontario sources, and do not assume its daily monitoring or snapshot files make immigration advice current or authoritative.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill claims that all policy judgments are based on live official sources, but the instructions also define substantial offline scoring logic and local cached snapshots/hashes that can drive decisions. In an immigration-advice context, this can mislead users into trusting stale or incomplete results as authoritative, causing materially incorrect eligibility or scoring guidance.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The README makes contradictory trust-boundary claims: it says the skill is fully local and requires no network, while also advertising real-time policy fetching, daily monitoring, and source auto-discovery from official websites. In a security-sensitive agent ecosystem, this can mislead users and reviewers about whether the skill may initiate network access, which affects sandboxing, consent, and data-exposure assumptions.

Intent-Code Divergence

Low

Confidence: 80% confidence
Finding: The README claims policy judgments follow real-time official sources but also treats a local snapshot as an official source, blurring the distinction between live authoritative data and cached content. This can cause users or downstream agents to over-trust stale local files as current policy, leading to incorrect decisions in a domain where accuracy and timeliness matter.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The code is explicitly offline and only reads JSON from stdin, yet the skill metadata promises real-time retrieval from official sources, update detection, and avoidance of stale data. In an immigration-policy skill, this mismatch can cause users to rely on outdated eligibility and scoring logic for high-stakes legal or administrative decisions.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The module docstring states the tool is local/offline and based on a snapshot, which directly contradicts the manifest's claim that all judgments follow live official sources and never stale offline data. This creates a deceptive trust boundary: operators or users may believe outputs are current when they are actually derived from embedded logic and static references.

Static analysis

No suspicious patterns detected.