Security audit

Skill Vitals — Skill Audit

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local audit tool for installed agent skills, but its reports and snapshots can expose private local paths and skill metadata.

Install this only if you want a local inventory and health audit of your agent skills. Treat generated reports, snapshots, and --deep log-probe output as private unless you use the redaction flags, because they may include absolute paths, usernames, skill names, descriptions, and local project context.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script promises a privacy-preserving behavior, but in --deep mode it prints concrete SKILL.md paths extracted from logs. File paths can reveal usernames, project names, directory structure, tenant identifiers, or sensitive internal naming, so the privacy claim is materially inaccurate and may cause operators to run the tool in contexts where they would not have consented to disclose metadata.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The final user-facing statement says the script does not output any business content, yet earlier code can emit raw file paths observed in logs. Even if payload contents are not printed, those paths are still log-derived data and may expose sensitive operational context, creating a misleading safety assurance that can lead to unintended disclosure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The description contains very broad activation phrases such as general troubleshooting and safety-review scenarios, which can cause the skill to trigger in many unrelated contexts. Because this skill performs auditing and judgment about other skills, over-broad invocation increases the chance of untrusted or unnecessary context being injected into conversations, creating confusion, misrouting, or expanding the attack surface for prompt-injection-style content from scanned artifacts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The default prompt uses a broad natural-language invocation phrase ("Use $skill-vitals to audit my installed Agent Skills...") while implicit invocation is enabled, which can cause the skill to trigger on common user requests about auditing skills, costs, or risks. This is dangerous because it increases the chance of unintended activation, potentially exposing internal inventory or causing the agent to perform actions the user did not explicitly request.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: README.md:1

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/guide.zh-CN.md:257