Security audit

Workspace Context Linter

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local diagnostic linter for workspace context files and does not show hidden, destructive, network, credential, or persistence behavior.

Install this if you want a local report about workspace context-file organization. Be aware that it reads files such as AGENTS.md, USER.md, MEMORY.md, and TOOLS.md, which may contain private preferences or environment details, and choose the --output path carefully because it can create directories and overwrite that report file.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to read multiple workspace files and optionally run a Python script that writes a report, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an implicit capability mismatch: an agent may perform file reads and writes without a constrained, auditable boundary, increasing the risk of overbroad workspace access or unintended modification/output behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The file hard-codes several natural-language phrases in Chinese for theme matching, such as '先确认', '隐私', and '简洁', which makes the linter behavior language-specific. There is no indication that users can opt into this locale restriction or that the skill is intended only for Chinese-language context files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 7% confidence
Finding: I found no natural-language policy violation here. The document offers both English and Chinese sections rather than requiring a specific language without user opt-in, so this should not be treated as a violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes a diagnostic linter for workspace context files, which implies analysis/reporting of those files. The implementation also creates directories and writes the generated report to a user-specified path, adding a filesystem modification capability not stated in the description.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: A workspace-context linter is expected to read context files and produce findings, but the code also performs directory creation and file writes to any provided output path. Optional report persistence may be useful, yet it is not clearly part of the stated purpose of auditing context-file roles and bloat.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.