Security audit

jash

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent skill-authoring helper, but its bundled local scripts have real filesystem boundary risks users should review before installing.

Install only if you trust the users and workspaces where it will be used. Run its scripts only on skill names you control, avoid absolute or parent-directory path components, do not package untrusted skill folders, and inspect for symlinks before creating a .skill archive.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/init_skill.py:206
Finding: Output Directory Escape Through an Unvalidated Skill Name
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/package_skill.py:68
Finding: External File Disclosure Through Symlink Following During Packaging
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill behaves like an instruction set for a command-line workflow operating on local paths, but that behavior is not surfaced in the metadata that determines triggering. Hidden operational scope is risky because the skill can be selected under the assumption it is merely instructional, while it actually authorizes schema enforcement, directory traversal, and output generation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill behaves like an instruction set for a command-line workflow operating on local paths, but that behavior is not surfaced in the metadata that determines triggering. Hidden operational scope is risky because the skill can be selected under the assumption it is merely instructional, while it actually authorizes schema enforcement, directory traversal, and output generation.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.
md
1. Understand the skill with concrete examples 2. Plan reusable skill contents (scripts, references, assets) 3. Initialize the skill (run init_skill.py) 4. Edit the skill (implement resources and write SKILL.md) 5. Package the skill (run package_skill.py) 6. Iterate based on real usage

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.
md
Any example files and directories not needed for the skill should be deleted. The initialization script creates example files in `scripts/`, `references/`, and `assets/` to demonstrate structure, but most skills won't need all of them. #### Update SKILL.md **Writing Guidelines:** Always use imperative/infinitive form.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · scripts/init_skill.py (reported line 266)May include surrounding context.
python
# Print next steps print(f"\n✅ Skill '{skill_name}' initialized successfully at {skill_dir}") print("\nNext steps:") print("1. Edit SKILL.md to complete the TODO items and update the description") print("2. Customize or delete the example files in scripts/, references/, and assets/") print("3. Run the validator when ready to check the skill structure")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill instructs the agent to create, edit, validate, and package skills via local scripts, which implies filesystem writes, reads, and shell execution, yet it declares no tool scope or permission boundaries. That omission can cause the agent to perform state-changing actions without explicit capability disclosure or gating, increasing the chance of unintended file modification or command execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The activation description is broad enough to trigger on many generic requests about creating or updating skills. Overbroad triggering increases the chance that the agent loads instructions that encourage file creation, editing, and script execution in contexts where the user may have wanted only conceptual advice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions tell the agent to run initialization and packaging scripts that create directories and produce archive files, but they do not require warning the user or obtaining confirmation before making filesystem changes. In an agent setting, this can lead to unexpected writes or artifact creation in user workspaces.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill requires testing added scripts by actually running them, but provides no safety guardrails about untrusted code, side effects, network access, or sandboxing. Executing newly created or modified scripts without restrictions can cause destructive local changes or unsafe external interactions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.