Security audit

Drinks Sommelier

Security checks for vulnerabilities and agentic risk

Overview

This beer and wine recommendation skill is coherent and not deceptive, but it keeps a local taste profile and uses web searches, so users should understand that before installing.

Install only if you are comfortable with the agent keeping local notes about your beer and wine preferences and searching the web for product details. Review or create the missing data files before use, and ask the agent not to save preferences if you want one-off recommendations only.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The activation description is broad enough that the skill may load during ordinary conversation about beers or wines, not only when recommendation help is needed. Overbroad activation increases the chance of unnecessary profile reading/writing or unintended external searches in contexts where the user did not ask for that behavior.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill directs the agent to build and persist a long-term taste profile and to modify both preference files and SKILL.md over time. That extends beyond one-shot sommelier advice into ongoing user profiling and memory persistence, which creates privacy and scope-expansion risk if the user was not clearly informed and did not consent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill describes reading and using stored taste data, but the top-level description does not upfront warn users that persistent preference data is maintained and consulted. That lack of transparency undermines informed consent and makes the profiling behavior more risky in context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instructions permit direct updates to persistent preference files whenever the user expresses a judgment, without an explicit upfront warning in the skill description. Even if framed as factual recording, silently persisting user preference data can surprise users and create privacy concerns, especially when activation is broad.

Context-Inappropriate Capability

Low

Confidence: 86% confidence
Finding: The skill mandates targeted web searches for each product, introducing external data retrieval behavior not clearly stated in the manifest description. This can expose user-provided product/context details to external services and changes the trust boundary of the skill, even if the purpose is legitimate.

Static analysis

No suspicious patterns detected.