agent-security-audit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 1.2.4

Overview

The skill is framed as a local security scanner, but its executable behavior is mainly a remote SaaS client that can send submitted code and an API key to a plaintext HTTP endpoint.

Review carefully before installing. Do not submit private code, secrets, customer data, or internal configuration unless you intentionally trust this remote SaaS service and override it to a verified HTTPS endpoint. The documented local-scan and --no-ai behavior is not implemented in the inspected script.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/audit.py:11

Finding

Plaintext Transmission of Source Code and Authentication Key to a Remote Service

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

User-provided code is sent to an external API endpoint for analysis, creating a direct data exfiltration path for source code, embedded credentials, infrastructure details, and other sensitive material. In the context of a security-audit skill, this is especially dangerous because users are likely to submit precisely the most sensitive code and configuration artifacts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares environment and network requirements via metadata and documented API usage, but it does not define an explicit tool/permission scope. That makes the operational boundary unclear and can enable broader-than-expected access when the skill is invoked, especially for a skill that may send scan data to an external AI endpoint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation conditions are very broad, covering generic security review, code review, compliance, CI/CD, and third-party inspection scenarios. This can cause the skill to activate in routine development conversations and run with access to files or sensitive code more often than users expect, increasing accidental data exposure risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The skill documents use of an external API endpoint for AI analysis, which creates a real data egress path. In the context of a security-audit tool that may inspect sensitive source trees, even sending 'summaries' externally can expose confidential code patterns, secrets, or metadata if not tightly controlled and disclosed.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash

export SECURITY_API_USER_KEY="你的DeepSeek API Key"
# 可选：自定义API地址
export DEEPSEEK_BASE_URL="https://api.deepseek.com/v1"

💡 不配置API Key也能使用，只运行静态扫描，跳过AI深度分析

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 99% confidence

Finding

The skill performs external transmission of supplied data to a backend API, and the default API base uses plain HTTP to a hard-coded IP address rather than HTTPS. This permits interception or tampering in transit and compounds the confidentiality risk from sending sensitive audit content and API keys to a remote service.

Content

Scanner excerpt · scripts/audit.py (reported line 24)May include surrounding context.

python

if method == "GET":
            resp = requests.get(url, headers=h, params=data or {}, timeout=30)
        else:
            resp = requests.post(url, headers=h, json=data or {}, timeout=60)
        if resp.status_code >= 400:
            try:
                err = resp.json()

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is marketed as a security audit helper, but it also performs account registration, account lookup, billing-related messaging, and service upsell. This scope expansion is risky because users may trust the skill with sensitive code while it operates as a broader SaaS client, increasing the chance of undisclosed data handling and purpose creep.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code forwards user-supplied audit content to a remote API, but there is no explicit user-facing warning or consent prompt before transmitting potentially sensitive source code. Because audit targets often contain secrets, proprietary logic, or internal URLs, silent external transmission materially increases confidentiality risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The generic services enumeration endpoint is unrelated to the stated purpose of code security auditing and exposes additional backend capabilities to the user. This broadens the operational surface and suggests the skill may be a thin wrapper over a multi-purpose remote platform rather than a narrowly scoped auditor.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest description forces a specific language/locale presentation for the skill metadata, and the file does not indicate that the skill is China-specific or that users may opt into another language. Under the policy, language constraints should either be optional or clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The documentation mentions that AI analysis may send summaries to a model, but it does not clearly warn that scanning a full directory and saving reports can itself aggregate secrets, personal data, or proprietary code indicators into output files. Those reports may then be stored, shared, or committed unintentionally.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This manifest describes the skill broadly as a security audit tool but does not define any specific invocation phrases, usage boundaries, or exclusion conditions. In manifest files, overly general descriptions without trigger constraints can contribute to unintended activation in contexts where generic security-review language appears.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The natural-language metadata includes a Chinese author name while the rest of the manifest is in English, which may indicate a locale-specific presentation choice. Because policy violations require language forcing without opt-in, this is only a low-confidence finding based on the visible metadata and lack of documented language-selection behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file contains user-facing natural language content exclusively in Chinese, beginning with the title and continuing throughout the checklist. Under the policy, forcing a specific language without user opt-in or documented justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

User-facing strings in the module docstring and CLI output are exclusively Chinese, and the script does not offer a language or locale option. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.