Security audit

Legionclaw Skill Manager

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a local skill creation and management aid whose file access is aligned with its stated purpose, with some normal caution because it can change persistent skill files.

Install only if you want an agent to help create or maintain local skill files. Review proposed SKILL.md diffs before approving changes, keep it pointed at a known skills folder, and avoid letting it edit shared or production skill libraries without a clear approval step.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill explicitly instructs the agent to traverse `skills/`, read existing `SKILL.md` files, create directories, write new skill packages, and run validation scripts, which are file read/write capabilities. Because no declared permissions are present, the effective authority is broader than what a permission model or reviewer can verify, increasing the risk of unintended workspace modification or data exposure if the skill is triggered in the wrong context.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrases include generic requests like '创建技能', '修改技能', and 'skill manager', which are broad enough to match ordinary conversation about skills rather than an intentional request to invoke this specific skill. Since this skill can read and write files and scaffold new packages, overly broad activation increases the chance of accidental invocation and unintended file operations.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The phrase '不限于此' makes activation open-ended and underspecified, encouraging the model to generalize beyond the listed examples. In a skill that performs local discovery, reads other skill definitions, creates files, and validates outputs, this ambiguity materially raises the likelihood of unintended activation and cascading workspace changes.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The specification explicitly encourages open-ended trigger phrasing via '常见说法（不限于此）' without requiring tight semantic boundaries or disambiguation rules. In a skill-manager context, that can cause overly broad activation criteria to be authored into downstream skills, increasing the chance of unintended invocation, prompt hijacking through ambiguous user phrasing, or accidental execution of powerful skill behaviors.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: Mandating that descriptions include trigger keywords, while not constraining those keywords to be specific, incentivizes authors to embed broad or generic terms for discoverability. In a skill creation/management system, this can propagate unsafe matching behavior across many generated skills, causing cross-triggering, accidental invocation, or abuse by phrasing requests to match unrelated but high-privilege skills.

Static analysis

No suspicious patterns detected.