Security audit

linkfox-skill-evaluator

Security checks for vulnerabilities and agentic risk

Overview

This is a skill-review workflow that is mostly coherent and proportionate, with some stale backup material and broad review claims users should treat as guidance rather than a guarantee.

Install only if you want a Chinese-forward skill evaluation workflow that may read and run checks against other skills you provide. Treat its conclusions as review guidance, especially when runtime tests are skipped or external APIs are unavailable. The stale bak/ files should ideally be removed before publishing to reduce confusion, but I did not find hidden persistence, credential access, exfiltration, or destructive behavior.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill claims to deliver a full safety-and-effectiveness evaluation, but much of the described behavior is aspirational and may not actually be enforced or executable in the target environment. This can mislead users into trusting a shallow or incomplete review as a comprehensive security audit, causing unsafe skills to be approved.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest description narrows the skill to effectiveness-only evaluation, while the surrounding context for this evaluator says assessments must always cover both safety and effectiveness. That mismatch can cause the agent to skip safety review when the skill is selected or routed based on manifest metadata, producing incomplete audits and false reassurance about unsafe skills.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The implicit trigger phrases are broad enough to match ordinary conversation such as asking whether something is useful, safe, or better than another version. In a skill that performs security and quality evaluation, overbroad auto-triggering can cause unintended activation, context capture, and misrouting of unrelated user requests into an evaluation workflow the user did not actually intend.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger description is broad enough to activate on many generic requests about whether something 'works' or is 'good,' which can cause the wrong skill to intercept unrelated tasks. Overbroad activation is dangerous because it may divert user intent, suppress more appropriate safeguards or domain-specific handling, and lead to misleading evaluations being presented as authoritative.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This file is entirely written in Chinese and operationally instructs the reviewer to use Chinese report labels and decision text, without any documented locale gating or user-language negotiation. In a general-purpose skill evaluator, forcing one language can cause reviewers or downstream users to miss important safety signals, misapply the process, or generate unusable audit output when the surrounding workflow expects another language.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/pre-check.py:253