linkfox-skill-creator

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:51 AM UTC
• Version: 1.0.0

Overview

This is mostly a legitimate skill-creation wizard, but it includes broad local script execution, remote install guidance, and persistent logs that users should review before installing.

Install only if you are comfortable with a skill that can create local skill directories, generate Python scripts, run local helper commands, invoke delegated linkfox tool scripts, and keep evaluation traces on disk. Review any generated workflow before running api_call.py, verify remote onboarding downloads yourself, and avoid putting secrets or sensitive business details into interviews or evaluation prompts unless you are prepared for them to be stored locally.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

out = Path(output_arg).resolve()
    out.parent.mkdir(parents=True, exist_ok=True)

    proc = subprocess.run(
        [sys.executable, str(target), params_arg],
        capture_output=True,
        text=True,

• Confidence: 96% confidence
• Finding: The code executes a user-supplied Python script path via subprocess without restricting which script may run. Although shell injection is avoided by passing an argument list, this still grants arbitrary code execution to anyone who can influence TARGET_SCRIPT, which is especially risky because the helper is framed as a generic wrapper for other skills and writes outputs to attacker-chosen locations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill directs generation of local files, copying templates, and execution of shell/Python workflows, yet it declares no permissions. That creates a misleading trust boundary: a user may invoke what appears to be a harmless interview wizard, while the skill is capable of writing artifacts and orchestrating code execution in the workspace.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The manifest frames the skill as a guided creator, but the instructions include behavior consistent with a generic script runner and data-wrapper utility via api_call.py and delegated tool execution. This mismatch is dangerous because it obscures the real execution surface and can cause users or reviewers to underestimate the skill's ability to run arbitrary Python scripts, pass parameters, and persist outputs locally.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill instructs downloading and installing another skill from a remote ZIP URL when troubleshooting onboarding issues. Introducing software installation behavior into a skill-creation wizard expands the attack surface to remote supply-chain risk and can lead to unreviewed code or instructions being brought into the environment under the guise of support.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The documented behavior extends beyond skill creation into API key, billing, quota, and onboarding troubleshooting. Broadening scope in this way is risky because it encourages the skill to interact with credential and account-management flows that users would not reasonably expect from the manifest, increasing the chance of phishing-like redirection or unsafe operational guidance.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The file contains conflicting instructions for delegate handling: one section says delegate steps do not generate scripts and should use nested skill invocation, while another mandates converting certain linkfox-* delegates to api_call.py and adding scripts/ content. This inconsistency can cause generators or downstream agents to choose the wrong execution path, bypass context-safety controls, or fail to enforce the intended disk-backed isolation for large tool outputs.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This helper's core capability is to run an arbitrary Python script specified at invocation time, which is far broader than the declared purpose of a skill-creation wizard. That mismatch matters because it creates an unexpected execution primitive inside a context where users or downstream agents may not anticipate that arbitrary local code can be launched.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The file implements a generic external-tool/script runner rather than logic specific to interviewing experts and generating skills. In a skill whose stated purpose is benign content creation, embedding a reusable execution wrapper increases attack surface and can enable capability creep, making dangerous behavior easier to trigger indirectly.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad and overlap with ordinary requests like 'create a new skill' or 'encapsulate this process,' which increases the chance of accidental activation. In context, accidental invocation is more dangerous because this skill can lead to file generation, delegated tool discovery, and execution-oriented workflows rather than simple conversational guidance.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: Requiring 5+ trigger phrases derived from user wording without requiring disambiguation, specificity, or exclusion criteria encourages overly broad routing metadata. In an agent ecosystem, broad triggers increase accidental activation, causing the skill to run in unrelated contexts and potentially invoke downstream tools or workflows when the user's intent does not match.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The mandated slash-separated description format incentivizes packing many natural-language trigger phrases into a single field, but it provides no guardrails against ambiguous or high-frequency phrases. This can make semantic matching noisy and increase misrouting or unintended activation of the skill, especially because the skill is a creator/generator that can produce further executable artifacts.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The handoff instructions require appending workflow metadata to interview-record.md, which changes what is presented as the original interview record without clearly informing the user. This can blur the boundary between source testimony and system-generated state, creating provenance and auditability issues, especially if the interview record is later relied on as an authoritative artifact.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The protocol explicitly requires archiving full spawn prompts and sub-agent responses into .eval trace files, which can capture sensitive user requests, system prompts, hidden policies, file paths, and potentially secrets from task content. Because the document also encourages broad logging for reproducibility and audit, the skill context makes this more dangerous: evaluator runs may process adversarial or confidential skill material, so persistent traces expand the exposure surface and create a durable data-retention risk.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The template encourages broad, generic trigger phrases in the public description field without requiring narrow activation constraints. That can cause unintended invocation of the skill in unrelated contexts, increasing the chance the agent applies specialized business logic when the user did not explicitly request it, which is a prompt-routing and scope-control weakness.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The subprocess invocation runs external Python code with no explicit warning, approval gate, or provenance check. Even if intended for internal tooling, the absence of confirmation and trust validation makes accidental or deceptive execution more likely, particularly in agentic workflows where inputs may be derived from untrusted prompts or generated paths.

Static analysis

No suspicious patterns detected.