Security audit

Security Audit

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local audit tool, but its scanner can miss important malicious-file patterns while still telling users a project is safe.

Install only if you treat it as a lightweight helper, not a reliable security gate. Run it only on the specific downloaded project or skill you intend to inspect, review any findings manually, and do not rely on a SAFE result before executing unfamiliar code.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: audit.py:99
Finding: String-literal removal allows suspicious payloads to evade content scanning
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: audit.py:179
Finding: Unknown and renamed binary files bypass high-risk file detection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: audit.py:228
Finding: Presence of any source file neutralizes high-risk executable scoring
Content: View full analysis
str: """Calculate overall risk level.""" critical_score = 0 # High-risk executables without source code if results['high_risk_files'] and not results['source_files']: critical_score += 3 # Large single-line files (potential shellcode) if results['large_single_line_files']: critical_score += 3 # README mismatch if results['readme_mismatch']: critical_score += 2 # Suspicious patterns if results['suspicious_patterns']: critical_score += len(results['suspicious_patterns']) if critical_score >= 5: return 'CRITICAL' elif critical_score >= 2: return 'WARNING' else: return 'SAFE' ``` ### Technical Analysis A high-risk file contributes to the score only when the entire scanned directory contains no recognized source files. The existence of any file with a suffix from `SAFE_EXTENSIONS` causes the condition to fail, even when that source file is unrelated to the executable and does not correspond to its source code. An attacker can therefore bundle a malicious executable with a trivial or empty `.py`, `.js`, or other recognized source file. In the absence of another signal, `critical_score` remains zero and the result is `SAFE`, despite `results['high_risk_files']` containing an executable. The implementation makes no attempt to establish provenance or correspondence between a binary and purported source code. Source availability cannot safely be inferred from the mere presence of an unrelated source file. ### Attack Path 1. An attacker places a malicious high-risk file such as `payload.exe` in a repository. 2. The attacker also adds an innocuous recognized source file, such as `placeholder.py`. 3. The scan records ...[truncated 808 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill describes workflows that read repositories and write audit reports, but it does not declare any explicit tool scope or permission boundaries. In a system that auto-invokes skills, this creates ambiguity about what filesystem actions are authorized and can enable broader-than-expected file access or modification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The automatic invocation rules are broad: they trigger after cloning repos, downloading skills, and before running external scripts, without defining trust boundaries, path constraints, or user confirmation requirements. This can cause the skill to run in unintended contexts, potentially touching sensitive directories or normalizing automatic processing of untrusted content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example output contains the Chinese term "疑似" in an otherwise English README. This introduces a mixed-language experience without user opt-in or a documented reason for the locale change, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Line L174 contains non-English text embedded in an otherwise English skill document, and the skill does not state that it is multilingual or give users a language/locale option. This can violate language consistency or locale-choice policies when users are not given opt-in.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: audit.py:41