Security audit

Sequential Read

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it claims, but it runs autonomous sub-agents over untrusted text and writes persistent reading data without enough scoping safeguards.

Review this skill before installing it for private or adversarial documents. It stores source-derived chunks and generated reactions under workspace memory, may update longer-lived reader context, and should ideally be run with filesystem access limited to the chosen source file and its own session directory.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: templates/reflection_prompt.md:19
Finding: Untrusted Source Content Is Embedded into Tool-Capable Agent Prompts Without Isolation
Content: View full analysis
Remediation: View remediation
{current_chunk_text} ``` 3. Apply the same handling to all attacker-influenced fields, including: - Source title and filename. - Reading lens. - Chunk metadata. - Prior reflections and annotations. - Optional reader-context files. 4. Enforce least privilege for spawned agents: - Restrict writes to the active session directory. - Restrict reads to the source file, skill files, and active session. - Disable network access unless explicitly required. - Do not expose credentials or unrelated workspace memory. 5. Add prompt-injection regression tests using documents containing requests to invoke tools, reveal files, alter roles, or ignore prior instructions. Confirm that such content is quoted and analyzed rather than executed. 6. Consider parsing and passing the source through a dedicated data-only interface or constrained worker instead of concatenating it into a general-purpose tool-capable agent prompt. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/session_manager.py:138
Finding: Session Identifier Path Traversal Permits Access Outside the Session Root
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a prose-reading workflow, but it also acts as a stateful orchestration and persistence layer that creates sessions, stores metadata, and manages disk-backed history. This mismatch can mislead reviewers and users about the real operational surface area, causing them to approve or invoke a skill without realizing it performs persistent storage and multi-step automation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes Python scripts, reads source files, and writes session state under memory directories, but it does not declare an explicit tool scope or permissions boundary. That increases the chance of overbroad execution in hosts that rely on manifest-declared capabilities, making file and environment access less transparent and harder to constrain.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The optional reader-mind files create durable cross-book profiles containing accumulated preferences, character knowledge, and thematic interpretations beyond a single reading task. That persistence is not necessary for the stated function and can silently build a long-lived user profile, increasing privacy and data-retention risk if the files are exposed or reused unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Loading and updating reader-mind files extends storage from session state into reusable long-term context, but the skill provides no privacy disclosure or consent mechanism for this profiling behavior. Because the files may contain inferred interests, opinions, and cross-reference observations, they create a more sensitive and durable data store than ordinary session logs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill states that reflections and state updates are persisted to disk automatically, but it does not clearly warn the user at invocation time that their reading material and generated reactions will be stored. Silent persistence can expose sensitive document contents or personal interpretations in workspace memory, especially for private manuscripts or confidential files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to persist reflections, annotations, and session status changes to disk without any user-facing disclosure or consent gate. In an autonomous loop, this can create or modify session data unexpectedly, which is risky because users may assume the skill only reads content rather than writing durable state and generated text artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to write a synthesis file into the workspace and to update session state to complete, but it does so without any explicit user-consent gate, warning, or confirmation step. In an agent setting, silent persistent writes and state transitions can modify user data or workflow state unexpectedly, especially if the session identifier or workspace context is wrong, stale, or attacker-influenced.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README explicitly says the skill 'handles everything autonomously' and documents creation of reflection and synthesis files under a memory path, but it does not clearly warn users up front that invoking the skill will write to the filesystem. This is a genuine transparency and safety issue because users may run the skill expecting read-only behavior on a local book file, while the skill persists derived content that could consume disk space or store sensitive text excerpts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.