Security audit

Docs Refresh

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent documentation-refresh workflow that reads repository state and may update docs, with no hidden persistence, credential use, network access, or destructive behavior found.

Install this only if you want an agent to inspect your repository changes and update documentation files. It is benign, but it can lead to doc edits, so review generated documentation changes before committing them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose describes a workflow that refreshes authoritative documentation via routed progressive disclosure. The supplied code does not refresh docs, route requests, or perform disclosure logic. Instead, it is a local shell test script that asserts certain strings are present in documentation files and exits with failure if they are missing. That is a materially different primary purpose: validating documentation content rather than updating or routing documentation workflows. No notable extra permissions are used beyond local file reads, but the functional mismatch is clear.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
md
2. Resolve the directory containing this `SKILL.md`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
ill directory against `[repo-root]`. Do not assume the target repo has its own `scripts/collect_changed_context.sh`.

Static analysis

No suspicious patterns detected.