Security audit

simplify-code

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent code-refactoring guide; the bundled executable files are evaluation harnesses, not normal skill instructions.

Installers should treat this as a refactoring skill that can modify local source files and run existing project verification when asked to edit code. Do not manually run the bundled eval harnesses on untrusted code unless they are isolated in a sandbox.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (38)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose is a refactoring assistant for simplifying code without changing behavior. The actual code does not perform refactoring or simplification at all; instead, it acts as an automated test script for a function named loadReport. It loads code from a user-supplied path, constructs fake asynchronous dependencies, checks expected outputs and call ordering, and validates error handling. This is materially different from the declared primary purpose. While tests can support refactoring in a broader workflow, this code chunk itself is specifically for testing/verification, which the description explicitly says is not the main task.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a refactoring/cleanup skill whose purpose is to rewrite code more cleanly without changing behavior. The supplied code does not simplify or transform code at all. Instead, it evaluates a calc function by loading a Python file, generating test cases, executing the function, and either writing expected outputs or checking them against a provided JSON file. This is a testing/validation utility, which the description explicitly says is not the main task. Therefore the actual behavior is materially different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is for a code refactoring/simplification skill. The provided code does not simplify or transform code at all; instead, it evaluates a Go implementation by running tests in a temporary directory. That is a materially different primary purpose: test harness/execution rather than refactoring. The filesystem copying and go test invocation are central behavior here, not incidental support for refactoring, and they are not reflected in the declared purpose or permissions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose is a refactoring/cleanup skill meant to simplify code without changing behavior. The actual code chunk is not implementing or demonstrating refactoring functionality; it is a unit test suite for ParseConfig. Its primary purpose is to verify parsing results and Go error semantics, including identity via ErrEmpty and unwrapping into strconv.NumError. Writing or supplying tests is explicitly outside the declared main task, and this code does not perform code simplification at all. Therefore the code’s behavior materially differs from the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description is for a code-refactoring assistant whose purpose is to simplify or clean code without changing behavior. The supplied code does not perform refactoring or code cleanup at all. Instead, it acts as an evaluation script for Rust code: it creates a temporary directory, copies an input implementation file, compiles a test harness with rustc, runs the resulting executable, and emits FAIL plus compiler errors on failure. This is materially different from the declared primary purpose and aligns more with code testing/assessment infrastructure, which the description even says is not the main task. The filesystem and execution behavior are consistent with a test runner, not a refactoring skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code does not perform code simplification or refactoring. Its primary purpose is to validate implementation behavior through unit-style assertions, including success cases, tie handling, empty-input handling, and expected panics. That is materially different from the declared refactoring/cleanup purpose, and writing or running tests is explicitly listed as out of scope in the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says the skill cleans up and refactors code while preserving behavior. The supplied code does not simplify or transform code at all. Instead, it acts as a checker for SQL solutions by setting up a SQLite database, loading SQL statements from files, executing them, and comparing actual versus expected query results. This is a materially different primary purpose and includes undeclared capabilities such as file-based SQL execution and test-result evaluation. Therefore the description does not accurately represent the code's behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is for a code-cleanup/refactoring skill whose purpose is to rewrite code while preserving behavior. The supplied code does not simplify or refactor code at all. Instead, it is an automated behavioral checker for a Bash script: it runs the implementation under multiple scenarios, inspects filesystem side effects, validates stdout and return codes, and reports pass/fail plus informational handling of spaces. That is materially different from the declared primary purpose and falls closer to testing/evaluation, which the description explicitly says is not the main task.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description is for a skill that rewrites or tidies code while preserving behavior. The actual code does not refactor code at all; it is an executable shell script implementing a file-copy/backup workflow. Its main behavior is operational filesystem manipulation: reading command-line arguments, listing files, creating directories, copying files, and reporting a count. That is a materially different primary purpose and includes side effects not implied by the declared skill description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a refactoring/cleanup skill that edits or improves code structure without changing behavior. The supplied code does not perform code simplification or refactoring at all. Instead, it acts as an evaluation harness: it compiles C++ code, injects the target file path as a macro, runs the resulting executable, and surfaces failures. This is a materially different primary purpose and introduces undeclared capabilities such as compilation, execution, and sanitizer-based runtime checking. While such testing could be supportive in another context, here the code chunk itself is clearly a checker, not a refactoring implementation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is for a refactoring/cleanup skill that preserves existing behavior and is not intended for writing tests as the main task. The actual code does not simplify or refactor code at all; instead, it acts as an evaluator/test runner for a Python function get_level. Its primary purpose is correctness checking via predefined cases, which is materially different from code cleanup. It also dynamically imports and executes a target file provided on the command line, an operational behavior not suggested by the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is a code-cleanup/refactoring skill. The actual code does not refactor or simplify code at all; instead, it executes a target Python module and checks whether its public API and behavior match expected outputs. This is effectively an evaluation/test script for API preservation and function semantics. While API preservation is mentioned in the description as a constraint during refactoring, the code's primary purpose is testing/verification, which the description explicitly says is not the main task. Therefore the code chunk materially differs from the declared skill purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is for a refactoring/simplification skill whose job is to rewrite code while preserving behavior. The supplied code does not simplify or refactor code at all; instead, it acts as an evaluation test script. Its primary purpose is to execute a paginate implementation, assert expected outputs for several edge cases, and fail if behavior differs. That is materially different from the declared purpose and falls into testing/behavioral verification, which the description explicitly says is not the main task. The dynamic module loading from process.argv[2] is also operational behavior not implied by the declared refactoring role.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this skill should refactor or simplify existing code without changing behavior or public APIs. The provided code chunk does not perform any refactoring, cleanup, or transformation of input code at all. It is a concrete library function that constructs and returns user data. Its primary purpose is business logic/API behavior, which is materially different from the declared skill purpose. Therefore this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says the skill simplifies/refactors code while preserving behavior and is not for writing tests as the main task. The supplied code does not refactor or simplify code at all. Instead, it acts as an automated evaluator that executes two implementations and checks whether their behavior matches on edge-case inputs (including non-integer and odd UID values and various flag argument patterns). Its primary purpose is testing/verification of behavioral equivalence, which is materially different from code cleanup/refactoring. The dynamic module loading and execution are consistent with a test harness, not a refactoring tool.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This code does not simplify or refactor code. Its primary purpose is to test whether a new implementation matches an old one on edge cases, especially hidden negative/fractional/NaN pagination inputs. That is a validation/testing activity, which the description explicitly says is not the main task ('Not for ... writing tests as the main task') and is also adjacent to bug-finding/behavior auditing rather than refactoring. Although such testing could support a refactor, the supplied chunk itself is a standalone test script, so the declared description does not accurately represent the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose is a refactoring/simplification tool for editing code without changing behavior. The provided code does not simplify or refactor code at all. Instead, it acts as an evaluator: it copies a user-supplied TypeScript file to a temp directory, invokes the TypeScript compiler, requires the compiled module, and runs assertion-based tests against exported functions. This is materially different from the declared purpose and falls into automated testing/behavior characterization, which the description explicitly says is not the main task. The filesystem, subprocess execution, and dynamic code loading are consistent with a test harness, not a code-cleanup skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill should clean up and refactor code without changing behavior. The actual code does not refactor or transform code at all; it acts as a checker that compiles a provided Java file together with a test file and executes the test. That is a materially different primary purpose: behavioral evaluation/testing rather than code simplification. Although compiling/running tests could be a supporting detail in some systems, here it is the entirety of the provided code chunk, so it represents an undeclared capability and a mismatch with the stated skill description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is for a code-cleanup/refactoring skill whose purpose is to simplify or reorganize code without changing behavior. The supplied code does not refactor or simplify code at all. Instead, it acts as an evaluation/test script: it creates a temporary workspace, copies in a TypeScript source file, compiles it with tsc, imports the resulting JS, executes runAll, and asserts expected outputs and event order. This is materially different from the declared purpose and falls into an area the description explicitly says is not the main task ('writing tests as the main task'). The filesystem and process-execution behavior are consistent with a test harness, not a refactoring tool.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
ferences/languages.md`, then read only the section for the language at hand in `languages-tier1.md` or `languages-tier2.md`. Each section lists common redundanc

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
ferences/languages.md`, then read only the section for the language at hand in `languages-tier1.md` or `languages-tier2.md`. Each section lists common redundanc

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This script copies a user-supplied Rust file, compiles it with rustc, and then executes the produced binary. Running untrusted user code creates a direct arbitrary code execution path on the host, which is especially risky because the skill's stated purpose is code simplification rather than sandboxed code execution.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This harness takes an attacker-controlled TypeScript file path from the command line, invokes tsc on it through a shell command, and then dynamically loads the compiled JavaScript with require(). That means untrusted code is not merely analyzed but executed during evaluation, enabling arbitrary code execution in the evaluator context; for a code-simplification skill, this is unnecessary and materially increases risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script compiles and then executes user-supplied Java code via java -cp . Test after incorporating the provided Index.java, which creates an execution path for untrusted code during evaluation. In a code-simplification skill, running submitted code is not necessary to fulfill the stated purpose, so this materially expands risk to arbitrary code execution on the host or in the evaluation environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This test harness invokes an external shell command using execSync and then dynamically loads the resulting compiled JavaScript. If process.argv[2] or the temporary/output paths are attacker-controlled, this creates command-injection and untrusted-code-execution risk during evaluation, which is especially dangerous because the harness immediately requires the produced artifact. In the context of a code-simplification skill, executing shell commands is not necessary for read-only analysis and materially expands the attack surface.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: evals/files/14-ts-generics/test.js:6

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: evals/files/17-ts-async-seq/test.js:3

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: evals/files/02-py-magic/test.py:2

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: evals/files/09-zh-python/test.py:2

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: evals/files/10-public-api/test.py:2

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: evals/files/12-hidden-nonint-uid/test.py:4