Security audit

idea-manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local idea-list manager that reads and changes IDEAS.md, with notable but purpose-aligned risks around deletion, archiving, and broad triggers.

Install only if you want an agent to maintain a persistent IDEAS.md file for you. Be specific about the target file when using it, review archive operations before confirming, and treat delete as permanent because there is no built-in undo.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill clearly performs file reads and writes to IDEAS.md and memory/ archives, yet no explicit permissions are declared in the metadata. This creates a transparency and policy-enforcement gap: an orchestrator or reviewer may underestimate the skill's ability to modify user data, increasing the chance of unintended or unauthorized file operations.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The archive operation does more than archive completed items: it also renumbers every remaining idea ID and rewrites references in at least one field. This hidden state-changing behavior can break external references, confuse users, and cause integrity loss in downstream tools or documents that rely on stable IDs.

Description-Behavior Mismatch

Low

Confidence: 84% confidence
Finding: When no local IDEAS.md exists, the tool silently switches to a home-directory workspace file, expanding the scope of file operations beyond the apparent current project. In an agent or automation context, this can lead to unintended reads/writes in a broader persistent store, causing data leakage or accidental modification of unrelated records.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The command description says archive completed entries, but the implementation also reindexes all remaining IDs. That mismatch is dangerous because users and higher-level agents may authorize a narrow archival action while the tool performs broader destructive changes than expected.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The description and activation guidance are broad enough to match ordinary conversation about ideas, proposals, or knowledge management, which can cause the skill to trigger when the user is discussing concepts rather than requesting file operations. Because the skill can rewrite and delete data, over-broad invocation materially increases the risk of unintended state-changing actions.

Vague Triggers

Low

Confidence: 84% confidence
Finding: The trigger phrase 'Idea list' is extremely vague and could be uttered in normal conversation without clear intent to invoke a file-managing tool. Even if the default action is a report, ambiguous activation can expose private workspace contents or begin a workflow the user did not explicitly request.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The delete command permanently removes entries immediately with no confirmation, dry-run, or recovery path. In a CLI skill meant for agent use, accidental invocation, argument confusion, or prompt-induced misuse can cause silent data loss in a user-managed ideas file.

Static analysis

No suspicious patterns detected.