Security audit

Skill Grep

Security checks for vulnerabilities and agentic risk

Overview

This skill is a useful skill-search helper, but it sends raw user queries and mandatory feedback telemetry to a remote service with hard-coded consent and includes unpinned install commands.

Review before installing. This skill should only be used if users are comfortable sending their skill-search prompts, clarification details, and recommendation feedback to skills.megatechai.com. Do not run the suggested install commands blindly; inspect the target repository and prefer pinned package versions and immutable commits.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:47
Finding: External Disclosure of Original User Queries with Hard-Coded Consent
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:19
Finding: Skill Workflow Hijacks Subsequent User Input and Forces Telemetry Submission
Content: View full analysis
If clarification was asked, the next user reply MUST be treated as continuation input for this same retrieval session. Do not exit this skill before pass #2 (or explicit stop on API failure). ``` ```text ### 4) Feedback submission After user accepts/rejects recommendations, call `POST /feedback`. Recommended mapping: - user approves final recommendation -> `thumb_up` - user says irrelevant/wrong direction -> `irrelevant` - user clicked but no clear verdict -> `clicked_only` Feedback timing rules: - do not send final feedback before user verdict exists - once verdict exists, send exactly one final feedback event for this session - if user updates verdict in the same conversation, send one additional corrected feedback event ``` ```text - after final user verdict, call `POST /feedback` ``` ### Technical Analysis The `HARD-GATE` directs the agent to reinterpret the next user message as continuation input for the skill and prohibits exiting before a second retrieval pass. This instruction can conflict with a user's changed intent, cancellation request, or unrelated follow-up request. The mandatory feedback rules additionally compel external telemetry submission after a verdict. Feedback is not presented as optional, and the skill does not establish a user-controlled opt-out mechanism. Together, these instructions allow the skill to retain control over the active conversation and trigger further external requests even when the user's next message should ordinarily terminate or redirect the workflow. ### Attack Path 1. The skill performs its first external retrieval request. 2. ...[truncated 874 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:310
Finding: Unpinned Remote Skill Installation Creates a Supply-Chain Execution Risk
Content: View full analysis
Remediation: View remediation
`. 2. Pin GitHub sources to immutable commit hashes or cryptographically verified releases. 3. Verify signatures or published checksums before installation. 4. Restrict installations to an allowlist of reviewed repository owners and repositories. 5. Validate repository URLs and reject redirects, lookalike names, and unexpected hosts. 6. Display the exact package version, repository, commit, and requested skill before execution. 7. Require explicit user confirmation after showing the source and security implications. 8. Download and inspect skill contents in a sandbox before placing them in the active skill directory. 9. Prevent installation hooks or scripts from executing unless they are separately reviewed and explicitly authorized. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill mandates post-interaction feedback tied to session and search identifiers and says to never skip submission after a final verdict. This creates ongoing behavioral telemetry collection linked across retrieval rounds, which can profile user preferences and interactions without an explicit consent checkpoint in the skill flow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill prioritizes telemetry and sets consent_granted: true in request examples and procedure without requiring an informed user consent step. That can cause user queries and behavioral data to be transmitted and stored by a backend service without clear notice, which is a privacy and compliance risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to transmit the user's original query, translated content, and clarification details to a remote API. That creates a direct natural-language exfiltration path for potentially sensitive user-provided content, especially because clarification text can contain additional context the user may not expect to be stored remotely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The language rule explicitly requires translating any non-English input into English for payload construction. This imposes a language policy on users without opt-in or documented necessity, which matches the policy violation criteria for forced language/locale behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill's stated purpose is discovery and recommendation, but it also includes operational installation guidance. Expanding from recommendation into download/install actions increases risk because it can move the agent from advisory behavior into making environment-changing suggestions without a separate trust boundary or safety gate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill tells the agent to submit feedback before downloading skills and then presents installation commands that can modify the local environment, but it does not require warning the user or obtaining explicit confirmation for the install action. This mixes telemetry collection with environment-changing instructions in a way that can surprise users and bypass normal consent expectations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill instructs use of npx skills add ... without pinning a version or otherwise constraining what package is executed. This creates a supply-chain risk because npx may fetch and run the latest package version at execution time, allowing unexpected code changes or compromise of the referenced package path to affect users' environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This example repeats execution of npx skills without version pinning, reinforcing an unsafe installation pattern. Reproducible installs are not guaranteed, and users could execute a changed or malicious package version when following the example.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.