Security audit

Realtor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow apartment-rental search helper that browses listed real-estate sites and returns matching Odessa listings, with no evidence of credential access, persistence, destructive behavior, or hidden execution.

Before installing, understand that this skill may browse multiple public real-estate sites when rental-related Russian trigger phrases are used. It is best suited for the fixed Odessa 2-room rental criteria shown in the skill; users who need other cities, budgets, languages, or explicit confirmation before browsing should adjust the skill first.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The skill description, triggers, workflow, and response template are all specified in Russian and do not indicate that the user may choose another language. This can violate language/locale policy when a fixed language is imposed without opt-in.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill does not clearly define when it should and should not run, so ordinary apartment-rental discussion may unintentionally invoke it. Because the skill is configured to browse multiple third-party sites and collect listings, ambiguous activation increases the chance of unintended autonomous web actions.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases are broad conversational phrases like 'найди квартиру' and 'что по аренде', which can easily match ordinary user requests outside a narrowly scoped invocation. This can cause the skill to activate unexpectedly and launch third-party browsing behavior without the user clearly intending to use this specific Odessa rental workflow.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The workflow instructs the agent to browse several external real-estate sites and gather listing data, but it does not warn the user that third-party browsing will occur. This reduces transparency and informed consent, especially if browsing reveals user interest patterns or causes external requests the user did not expect.

Static analysis

No suspicious patterns detected.