Security audit

Madeira

Security checks for vulnerabilities and agentic risk

Overview

This is a content-only Madeira travel and relocation guide with no executable behavior, though users should verify legal and tax details before relying on them.

This skill is reasonable to install as a Madeira reference guide. Treat its visa, registration, healthcare, and tax information as orientation only, and confirm current requirements with official Portuguese sources or qualified professionals before making relocation, work, or filing decisions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The phrase "User asks about Madeira for any purpose" is extremely broad and lacks exclusion criteria or narrow trigger examples. This can cause unintended invocation on casual mentions of Madeira rather than requests that actually need this skill.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The text explicitly minimizes a legal compliance requirement by saying Portugal 'doesn't aggressively enforce this' and implying users are generally fine without emphasizing that registration is still mandatory. In a relocation/visa guidance skill, this can mislead users into non-compliance, creating legal, administrative, healthcare, banking, or tax problems even if formal penalties are infrequent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The FAQ answers 'Practically, enforcement is light' immediately after acknowledging a legal duty to register, which downplays compliance risk without explaining potential consequences of failing to do so. Because this skill is presented as practical relocation advice, users may rely on this framing and choose non-registration, exposing themselves to avoidable legal and administrative issues.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This file gives specific tax thresholds, deadlines, and regime descriptions while also acknowledging that Portuguese tax rules are actively changing, but it does not present a prominent overall warning that the information may be outdated, incomplete, or unsuitable as legal/tax advice. Users may rely on stale guidance for residency, NHR/IFICI eligibility, VAT thresholds, or filing deadlines and incur penalties, missed elections, or improper tax reporting.

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: The line states "Language: Portuguese" as a declarative constraint, but the skill does not explicitly present this as local context versus an interaction policy with user choice. Under the policy, locale or language constraints should be optional, user-selected, or clearly justified when restrictive.

Natural-Language Policy Violations

Low

Confidence: 81% confidence
Finding: The greetings section prescribes specific Portuguese expressions and gendered thank-you forms as the expected way to communicate. Under the policy, language or locale constraints should either be optional or clearly justified; here the content presents a language preference without explicit opt-in language.

Static analysis

No suspicious patterns detected.