Wine Cellar

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:05 AM UTC
• Version: 1.0.0

Overview

This skill is a local wine-cellar helper that stores wine inventory data in JSON files and shows quality gaps, but no hidden, destructive, exfiltrating, or privilege-escalating behavior was found.

Install only if you are comfortable keeping wine inventory and related purchase or consumption notes as local JSON files inside the skill directory. Treat it as an incomplete prototype: several advertised helpers are missing, and the included barcode and pairing scripts need a small import fix before they run.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description promises substantial end-user functionality, but the provided code chunk does not implement any of it. It is effectively an empty package initializer with only a comment, so the actual behavior does not match the declared purpose. There are no undeclared capabilities present; instead, the mismatch is that the claimed primary purpose and features are unsupported by the supplied code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description presents a broad, comprehensive wine cellar management skill with multiple user-facing capabilities. The supplied code only covers a narrow subset: barcode normalization, lookup from a local JSON reference and cache, and adding a found wine to a local inventory file. That subset is related to the declared barcode/inventory aspects, but the overall declared description materially overstates the implemented functionality in this code chunk. There are no undeclared risky behaviors or inconsistent permissions/resources beyond local file access, but there is still a description-versus-behavior mismatch because most of the advertised core capabilities are absent.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises file-backed persistence and references executable scripts, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where the runtime may grant broader file read/write capability than users or reviewers expect, increasing the risk of unintended access or modification of local data.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation wording is broad enough that normal conversation about wine, meals, purchases, or recommendations could unintentionally trigger the skill. In context, this matters because the skill also claims persistent storage and logging features, so accidental invocation could lead to unwanted data recording or file modifications.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that it persistently stores inventory, consumption history, purchase records, and cached lookup data in local JSON files, but it provides no clear privacy notice, retention policy, or user consent flow. Because these records can reveal personal habits, spending patterns, and social associations, silent retention increases privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code performs a persistent file write to the inventory when extra command-line arguments are present, and the write is triggered automatically rather than after a user confirmation step. Although there are print statements announcing the action, there is no explicit prompt to confirm a potentially data-modifying operation before `add_wine_from_barcode` writes to `wine_inventory.json`.

Session Persistence

Medium

• Category: Rogue Agent

Content

try:
            vintage_int = int(vintage)
            # Very basic: younger wines for lighter dishes, older for richer
            # This is overly simplistic but demonstrates concept
            score += 5
            reasons.append(f"Vintage {vintage} considered")
        except ValueError:

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This code file performs a file access operation by loading `wine_inventory.json`, but there is no confirmation prompt or explicit user-facing notice near the operation itself. While the script's purpose implies recommendation from inventory, the code does not disclose that it reads local inventory data when invoked.

Static analysis

No suspicious patterns detected.