Security audit

Idea Darwin 日本語版

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local brainstorming workflow that creates and updates project notes, with no evidence of hidden network access, credential use, or destructive behavior.

Install this only if you want a skill that maintains local project files for brainstorming. Use it in a dedicated folder or version-controlled workspace, review generated changes after each round, and keep backups of important idea files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The skill's init flow creates multiple directories and files in the working directory, but it does not clearly warn the user up front that invoking initialization will perform filesystem writes and scaffold a project structure. This is dangerous because users may run the command expecting analysis only, while the skill modifies the workspace and persists state, which can be surprising in sensitive or shared repositories.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: The round execution flow repeatedly updates cards, reports, graph data, leaderboard state, and config without a prominent user-facing warning that each round is a mutating operation. This can lead to unintended persistent changes across many files, especially if a user expects '/idea-darwin round' to be a dry analysis step rather than an automated write-heavy workflow.

Static analysis

No suspicious patterns detected.