Security audit

Achievement Unlock Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a self-contained reflection prompt/helper with no evidence of hidden access, persistence, network use, or destructive behavior.

Installing this appears reasonable from a security perspective. Treat it as a prompt-style reflection aid rather than automated analytics, and avoid sharing sensitive personal details unless you are comfortable with the agent using those details in its generated review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code's primary behavior is metadata/template loading and rendering: it reads a local SKILL.md file, extracts headings like purpose/workflow/output format, and formats them into a guidance card. While it includes the user's input as context, it does not analyze recent progress or generate a game-style achievement board. This is a material purpose mismatch, not merely an implementation detail. The file access to SKILL.md is also central to the behavior and unrelated to the declared end-user function.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a concrete reflective transformation: turning recent progress into a game-style achievement board with evidence, rarity, near-unlock targets, and hidden growth signals. The supplied code chunk does not implement that behavior. Instead, it contains tests asserting that metadata and prompt sections load correctly and that handle() returns descriptive text including the skill slug, workflow, output format, the original input, and a note that content was loaded from SKILL.md. This indicates the actual behavior is about loading and presenting skill documentation or a guide card, not producing the described achievement-board analysis. No suspicious extra permissions/resources are evident in this chunk, but the primary purpose is materially different from the declared one.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The output unconditionally adds a "Chinese name" field whenever one is present in SKILL.md. This introduces a locale-specific presentation choice in the generated response without checking whether the user requested Chinese or whether the skill is explicitly region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.