Security audit

CSPR Source Scout

Security checks for vulnerabilities and agentic risk

Overview

This skill is for personalized source discovery, but it broadly sends profile- and history-derived interests to many external services without clear per-provider user approval.

Review this before installing if your profile or browsing-derived history may contain sensitive interests. Use it only when you are comfortable with inferred interests being searched across many third-party platforms, and prefer disabling routes or authenticated tools you do not want associated with your accounts.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:11
Finding: Mandatory Multi-Provider Disclosure of Private Preference-Derived Queries
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep