Security audit

MdSpliter

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documentation-organization helper that reads and restructures markdown knowledge files, with no evidence of hidden execution, credential access, network access, or destructive behavior.

Install this if you want an agent to organize large markdown knowledge files into indexed chunks. Review target paths before allowing writes, especially because some triggers are broad, and prefer using it on documentation folders rather than private or sensitive files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The manifest description is written entirely in Chinese and presents the skill's behavior and usage context only in that language. This creates a locale/language constraint without any stated opt-in, alternative language support, or justification for why the skill must operate in Chinese.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The Gene's signals_match list uses generic phrases like 'load full file' and 'index knowledge' that can easily appear in ordinary user requests unrelated to this specific transformation. In an agent environment, overly broad activation conditions can cause unintended invocation of the skill, leading to unnecessary filesystem modifications such as creating chunk directories and rewritten knowledge structures.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The Capsule trigger list repeats ambiguous phrases such as 'knowledge too large' and 'chunk knowledge' without clear scoping or confirmation requirements. Because Capsules are meant to auto-activate from prior successful patterns, broad triggers raise the chance of accidental execution in benign conversations, increasing the risk of unauthorized or unexpected changes to documentation layout.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The manifest explicitly instructs the agent to create a new subdirectory, split an existing knowledge file into multiple new files, generate an INDEX.md, and update the workflow, but it does not require any user confirmation, preview, or disclosure before modifying the repository. In an agent setting, silent file creation and transformation can cause unintended data changes, overwrite risks, and workflow drift, especially when operating on broad markdown knowledge bases.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The package description is written only in Chinese ("大型知识文档分块查阅工具"), which signals a language-specific presentation without any indication of user opt-in or multilingual support. This can violate a language/locale policy when skills are expected to be language-neutral or to offer a choice.

Static analysis

No suspicious patterns detected.