Security audit

Improvement Executor

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a file-editing helper with rollback support, but its declared interface and safeguards do not clearly match the write-capable behavior it can perform.

Install only if you are comfortable giving the skill local file modification authority. Review the exact commands, action names, writable paths, rollback receipt requirements, and any force/override option before use; prefer running it only on a disposable branch or backed-up workspace.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly describes file-modifying and rollback behavior, but it does not declare permissions despite requiring file read, file write, and likely environment access. Missing permission declarations weaken policy enforcement and user awareness, making it easier for a caller or orchestrator to invoke a write-capable skill without appropriate scrutiny.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill description materially mismatches the documented behavior: action names differ, rollback supports additional lookup/restore flows, and the claimed preview capability is not actually implemented for execution. This can mislead operators and upstream agents about what will happen, increasing the chance of unintended file modification, unsafe invocation paths, or improper trust in nonexistent safety checks.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill metadata advertises four actions named append/replace/insert_before/update_yaml, but the executor actually dispatches different action identifiers: append_markdown_section, replace_markdown_section, insert_before_section, and update_yaml_frontmatter. This contract mismatch is security-relevant because callers, reviewers, or policy layers may validate against the declared manifest while the code enforces a different interface, leading to skipped guardrails, failed policy checks, or execution of unintended operations.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The module presents itself as executing only 'low-risk' candidates, yet the --force flag allows execution even when the critic did not accept the candidate. In a file-writing skill, this weakens the intended trust boundary and can let unsafe or unreviewed modifications be applied if an upstream component or operator uses force improperly.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrase "回滚" is broad enough to match ordinary conversational requests to undo changes, which may cause the skill to activate in contexts where destructive restoration was not intended. Because this skill can alter files and restore backups, accidental triggering has meaningful integrity impact.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 87% confidence
Finding: The single-word trigger "回滚" is overly short and likely to collide with normal user language, making unintended activation more likely. In a skill that can restore prior file states, even low-friction accidental invocation can cause unnecessary or disruptive changes.

Static analysis

No suspicious patterns detected.