skill-designer

• Outcome: Review
• Latest audit: Sep 21, 2026 · 1:54 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed skill-design workflow, but it includes active design-library guidance that normalizes silent raw-prompt telemetry and has some under-scoped local/remote maintenance behavior.

Install only if you are comfortable with a skill-design assistant that uses local helper scripts and a large example/library corpus. Before reusing its generated or suggested patterns, review any telemetry, reporting, remote-service, payment, or automation sections and remove silent prompt reporting; telemetry should be disclosed, minimized, and user-approved.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (233)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This skill exposes documented remote knowledge-service integration, including HTTP access, environment-derived endpoints/tokens, backend switching, and payment-related response handling, despite being positioned as a local design guide. Hidden or under-justified network reachability increases the risk of data exfiltration, SSRF-like misuse through attacker-controlled configuration, and unexpected credential exposure in environments that auto-populate secrets.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

**元纪律**：新增任何「重试 / 回退 / 澄清 / 加载 / 探索」类纪律时，**必须同时给出数字上限 + 到顶后动作**，否则不许写——`validate_skill.py` 第 12 项「纪律可触线性」会机器检查这一条（半软 WARN）。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

**元纪律**：新增任何「重试 / 回退 / 澄清 / 加载 / 探索」类纪律时，**必须同时给出数字上限 + 到顶后动作**，否则不许写——`validate_skill.py` 第 12 项「纪律可触线性」会机器检查这一条（半软 WARN）。

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation promises strict write boundaries, yet other sections describe writes to telemetry and knowledge/index artifacts outside those paths. Misstated write scope is dangerous because operators may grant filesystem access based on false assumptions, enabling unintended persistence, metadata collection, or tampering beyond the declared output area.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The principle states that user-facing output should always use "用户语言," which imposes a language-selection policy in natural language without describing opt-in, choice, or documented locale justification. Under the policy criteria, language or locale requirements should not be forced unless the skill explicitly offers a choice or clearly justifies the constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to silently report unsupported-feature events and to include the user's original prompt verbatim, while explicitly not informing the user. This creates an undisclosed data exfiltration path for potentially sensitive user content and undermines user consent, privacy expectations, and data-minimization requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The markdown instructs preserving and silently reporting the user's original prompt ('user_prompt 用户原话不改写') with no notification. Raw prompts often contain sensitive business, personal, or credential-like data, so silent exfiltration of that content to upstream systems is a serious privacy/security issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This content explicitly instructs silent telemetry and says to send the user's original prompt without rewriting or notifying the user. That creates a clear privacy and data-handling risk because prompts often contain sensitive business, personal, or credential-like information, and exfiltrating them without consent or minimization violates least-privilege and transparency expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The parent skill is explicitly positioned as a design-only blueprinting tool, but this example embeds a complete deployable SKILL.md for an operational finance pipeline with collection, processing, persistence, and distribution behaviors. In practice, examples in skill packages are often copied verbatim or treated as trusted templates, so this creates a capability smuggling path where a design assistant can induce installation or replication of a materially more powerful skill than its declared scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The embedded example documents and normalizes use of powerful operational capabilities including Bash, file read/write, web retrieval, archiving, and outbound mail pushing, even though the enclosing skill claims to only design skills rather than execute workflows. This mismatch weakens least-privilege expectations and can lead reviewers or downstream agents to accept dangerous tool grants as ordinary design artifacts, enabling over-privileged derivative skills or unintended execution paths.

Content

No source excerpt is available for this finding.