Security audit

huditest

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a legitimate skill-building toolkit, but it deserves Review because some helpers can terminate local processes and use the user's Claude CLI session with locally stored eval content.

Install only if you are comfortable with a skill that creates and modifies files, runs local Python helpers, spawns eval work, opens local HTML/browser views, and uses your Claude CLI session for optimization. Before running the viewer, check whether its port is already in use; before running evals or description optimization, remove secrets or proprietary data from prompts, outputs, and skill files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script automatically enumerates any process bound to the requested port and sends SIGTERM to it before starting its own server. This can kill unrelated local services, interrupt developer workflows, or terminate security-sensitive processes if the chosen port overlaps with another application. In a skill tool that may be run repeatedly by users, this makes the behavior more dangerous because it is packaged as a convenience feature rather than an explicitly destructive action.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The guidance explicitly recommends making descriptions 'pushy' so the skill triggers even when users do not ask for it directly. Overbroad triggering can cause this high-privilege skill to activate in unrelated contexts, leading to unnecessary file creation, shell execution, eval runs, and benchmark tooling being invoked for prompts that did not warrant those side effects.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The skill directs the agent to generate files, launch a viewer, and open browser-based review flows without first warning the user about these side effects or obtaining consent. While not inherently malicious, automatic browser opening and filesystem writes can surprise users, expose local paths, or create artifacts and background processes they did not intend.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Main unconditionally calls _kill_port(port) before trying to start the HTTP server, and the user is not warned at execution time that an existing process may be terminated. That creates surprising destructive behavior with potential denial-of-service impact on local applications and increases the chance of accidental misuse. In the context of a local eval-viewing utility, silently killing another process is not necessary for core functionality and is therefore harder to justify.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script persists evaluation history, queries, and generated descriptions to local HTML/JSON files, which may include sensitive prompts, model outputs, or proprietary skill content. Because this happens by default and without a clear warning or explicit consent, users can unintentionally leave sensitive data on disk where it may later be accessed by other local users, backup systems, or support tooling.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: Automatically opening the generated report in a browser exposes potentially sensitive evaluation content immediately to the desktop environment and browser ecosystem without explicit user approval. This increases the chance of unintended disclosure through browser history, session restore, synced browsing data, screen sharing, or local shoulder-surfing, especially since report generation is enabled by default via the 'auto' setting.

Static analysis

No suspicious patterns detected.