Security audit

semantic-split

Security checks for vulnerabilities and agentic risk

Overview

This skill is a task-planning helper, but it under-discloses broad activation, persistent local writes, model/dependency installation, and optional memory-log processing.

Install only if you are comfortable with a planning skill that may activate on broad requests, write reusable task templates to disk, download/install ML dependencies or models, and potentially process memory logs if automation is configured. Review generated JSON before reuse, avoid using it with sensitive tasks, and prefer explicit invocation plus confirmation before any persistence or automation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares `sensitive_access: false` and `critical_write: false`, yet its documented behavior includes shell execution, file reads/writes, and likely environment access via Python scripts. This mismatch can cause the host or user to under-estimate the skill's privileges, making unsafe execution or approval more likely.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a semantic planning tool, but the detected behavior extends to downloading models, scanning caches, installing dependencies with pip/PyTorch, and managing a JSON repository through a CLI. Those side effects materially expand the attack surface to package supply chain, filesystem modification, and unexpected system changes beyond the stated purpose.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The documented heavyweight automation expands the skill from semantic splitting into scheduled scanning of recent memory logs and bulk generation of persistent JSON artifacts. This creates a clear scope mismatch and introduces unattended access to potentially sensitive historical task data, which can lead to over-collection, unintended retention, and writes beyond what a user would reasonably expect from the skill description.

Description-Behavior Mismatch

Low

Confidence: 78% confidence
Finding: The lightweight task persistently synthesizes rule-level JSON from accumulated capability files and stores derived datasets under the skill's data area, but this persistence behavior is not clearly surfaced in the high-level skill description. While less severe than log scanning, it still changes local state and can silently accumulate derived data that users did not explicitly request or understand.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The `generalize` subcommand accepts a user-controlled `--output` path and writes JSON there without constraining it to the declared managed data directory. In an agent or automation context, this can be abused to overwrite or drop files elsewhere on disk, violating repository scoping and potentially clobbering sensitive files the process can access.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The `rule-gen` subcommand allows `--output` to be an absolute path, and even relative paths are not normalized against a strict allowlist except for one branch. That means a caller can cause generated rule files to be written outside the skill's standardization store, which is dangerous in agent workflows where arguments may derive from untrusted input.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The `create` subcommand uses `Path(output)` directly when `--output` is supplied, so a caller can create files anywhere the process has write permission rather than only under the capability/rule store. In a privileged or automated execution environment, this becomes an arbitrary file write primitive.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The documentation states that outputs are uniformly stored in a fixed standardization directory, but multiple code paths allow arbitrary output destinations. This mismatch is security-relevant because operators and higher-level agents may trust the documented containment guarantee and pass untrusted inputs under that false assumption.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill persists auto-generated templates derived from user input and inferred steps to a shared on-disk capability store, creating stateful behavior beyond simple semantic splitting. This can unintentionally retain sensitive user content, poison future matching behavior, and change later outputs based on prior inputs without explicit consent or governance.

Vague Triggers

High

Confidence: 90% confidence
Finding: Trigger phrases such as '帮我做', '我需要', and '帮我分析' are extremely broad and overlap with ordinary conversation. This increases the chance the skill activates unintentionally and performs scanning, planning, or write-capable workflow steps in contexts where the user did not intend to invoke it.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The documented positive examples remain broad enough that many normal requests for help with planning or analysis could activate the skill. In a skill that can route into template reuse, JSON management, or automatic persistence, ambiguous activation raises the risk of unintended processing and data writes.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The workflow states that results are automatically generalized and saved into `capabilities/{task}_v1.json`, but there is no clear user-facing consent step or warning. Automatic persistence can store sensitive task content, derived business logic, or user data to disk without the user's awareness.

Vague Triggers

High

Confidence: 96% confidence
Finding: The trigger phrases are generic conversational Chinese such as "帮我做", "我需要", and "帮我分析", which commonly appear in normal user requests unrelated to this skill. This creates a high risk of unintended activation, causing the skill to intercept broad classes of requests and influence planning or execution flows outside its intended scope.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list provides no clear activation boundaries, domain restrictions, or disambiguation logic, so the skill may activate whenever loosely related phrasing appears. In a planning-oriented skill that restructures user intent, underspecified activation increases the chance of silent takeover of requests and unexpected agent behavior.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The task explicitly reads recent memory logs and writes generated JSON files without any notice, consent flow, or warning about data access and filesystem modification. This is dangerous because logs may contain sensitive user content, and silent transformation into long-lived artifacts increases exposure, retention, and surprise side effects.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The download flow deletes any existing target directory with shutil.rmtree and then copies new content into place without confirmation, backup, or path-hardening. If the target path is replaced by a symlink or the index/path assumptions are disturbed, this can cause unintended local data loss or overwrite of files under the executing user’s permissions.

Natural-Language Policy Violations

High

Confidence: 98% confidence
Finding: The divergent system prompt explicitly states that hard constraints may be 'slightly broken,' which teaches the agent to treat safety or policy boundaries as negotiable during planning. In an agentic workflow, this can produce plans that bypass user, organizational, or security restrictions and normalize unsafe escalation across later execution stages.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code automatically writes user-derived template files to disk without user confirmation, notice, or an approval gate. This creates silent persistence of possibly sensitive prompts and inferred workflow data, and also enables unreviewed data to influence future behavior through template reuse.

Ssd 4

Medium

Confidence: 96% confidence
Finding: The prompt embeds constraint bypass into a structured multi-step workflow: first generate an aggressive plan that can exceed hard limits, then integrate its innovations into the final plan. Even if risks are labeled, this pattern conditions the agent to operationalize incremental policy evasion as a normal part of planning and can leak unsafe ideas into the integrated result.

Static analysis

No suspicious patterns detected.