Security audit

Ai Folder Organize

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent local file-organizer bridge, but it gives an agent broad local file-context access and includes over-directive output and apply-plan instructions that users should review first.

Install only if you intentionally use Firefly AI Folder and are comfortable letting the agent query local workspace names, paths, file-analysis metadata, and search results. Review any generated organization plan in the desktop app before confirming it, especially if it may move or rename real files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill presents itself as a file-organization helper, but its documented behavior includes host discovery, local installation probing, region detection, config-file reading, service reachability checks, and mandatory display of promotional/download text from `stderr`. That mismatch is dangerous because it can mislead users and reviewers about the actual trust boundary, causing them to approve execution of local reconnaissance and marketing behavior they did not knowingly consent to.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README promotes applying organization plans and notes that virtual structures can also be exported or applied to move real physical files, but it does not place a clear, prominent warning near those features about the risk of modifying or relocating user files. In an agent-integrated skill, vague documentation can lead users or higher-level automation to treat file reorganization as safe-by-default, increasing the chance of unintended destructive changes or data disorganization.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly advertises capabilities to export or apply organization plans to real directories, including moving files and smart renaming, but it does not clearly warn users that these actions can modify local data and may be difficult to reverse. In the context of an AI-agent skill that can drive local file operations, missing safety disclosures increases the risk of unintended destructive changes from over-trusting automated suggestions.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill description says AI-generated organization structures can be pushed to the client for preview and application, but it does not clearly state that application may result in changes being enacted in the user's file organization workflow. Because this skill is specifically designed to connect an AI agent to local file-management functionality, weak disclosure around apply-style actions can mislead users into underestimating the consequences of agent-generated plans.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The documented endpoint allows AI-generated organize plans to be injected directly into the client’s organize UI and automatically prefilled, causing a workflow transition in the local application before the user has reviewed provenance or safety. Even though the final action appears to wait for user confirmation, this pattern can facilitate prompt-injection-driven unsafe recommendations, deceptive plan content, or accidental workspace-impacting actions if users trust AI-generated plans without clear warnings.

Static analysis

No suspicious patterns detected.