Security audit

Report

Security checks for vulnerabilities and agentic risk

Overview

This reporting skill is purpose-aligned and discloses its local storage, scheduling, credential handling, and external delivery behavior.

Install only if you are comfortable with a skill that can create scheduled report jobs, keep report data under ~/report, and send report contents to destinations you configure. Use local file delivery for sensitive reports, verify webhook/email/Telegram targets, and provide API keys only through environment variables as documented.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill uses broad natural-language invocation examples like 'List my reports', 'Pause X report', and 'Run X now' without defining clear activation constraints or requiring an explicit namespace/intent trigger. In an agentic environment, this can cause the skill to activate unexpectedly during ordinary conversation, leading to unintended reads or modifications of local report data and possible unintended report execution or delivery.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Webhook delivery sends report contents to an external URL, but the documentation provides no user-facing warning, consent step, or validation guidance. Because reports may contain sensitive operational, financial, or personal data, silent delivery to third-party endpoints increases the risk of unintended exfiltration or disclosure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The on-demand invocation examples are generic natural-language phrases that could easily appear in ordinary conversation, making unintended skill activation more likely. In a reporting skill, accidental invocation can trigger report generation or delivery actions without clear user intent, potentially exposing sensitive business or personal data through configured channels.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The manifest describes a skill that configures recurring reports and handles scheduling and formatting. The PDF generation instructions specifically invoke a browser action against a local file URL, which introduces a browser automation capability beyond simple report formatting and is not clearly justified from the manifest alone.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The example schema specifies Europe/Madrid as the timezone, which imposes a locale-specific default in natural language documentation. Because the file does not indicate that users may choose another timezone or that this locale is only an example, it risks violating the policy against forcing a specific locale without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.