Skill Creator

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:08 AM UTC
• Version: 1.2.0

Overview

This skill is a coherent AgentSkill authoring helper; it can create, edit, validate, and package skill files, but I found no hidden execution, exfiltration, or deceptive behavior.

Install this only if you want an agent to help create or modify AgentSkill packages. Review generated skill changes before using or publishing them, and be careful when adding real secrets, persistent memory, or hooks to any skill this tool helps author.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The reported behavior expansion into packaging and test-like/archive-handling workflows exceeds the declared review/editing purpose and can expose filesystem/archive behaviors not obvious from the trigger text. Even if some of the static-analysis wording references related files or inferred capabilities, the core issue remains that the skill's activation criteria are broader than its stated side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The reported behavior expansion into packaging and test-like/archive-handling workflows exceeds the declared review/editing purpose and can expose filesystem/archive behaviors not obvious from the trigger text. Even if some of the static-analysis wording references related files or inferred capabilities, the core issue remains that the skill's activation criteria are broader than its stated side effects.

Self-Modification

High

• Category: Rogue Agent

Content

- Specific triggers/contexts for when to use it
- Concrete examples of user requests that should activate it

#### Write SKILL.md Body

Keep under 500 lines. Use references/ for detailed content.

• Confidence: 89% confidence
• Finding: The skill explicitly guides writing and modifying SKILL.md and restructuring skill contents, which is a self-modification capability when used within a live agent-skill environment. Self-modifying instructions are high risk because they can alter future agent behavior, broaden triggers, or smuggle in unsafe tool guidance that persists beyond the current session.

Self-Modification

High

• Category: Rogue Agent

Content

# Print next steps
    print(f"\n[OK] Skill '{skill_name}' initialized successfully at {skill_dir}")
    print("\nNext steps:")
    print("1. Edit SKILL.md to complete the TODO items and update the description")
    if resources:
        if include_examples:
            print("2. Customize or delete the example files in scripts/, references/, and assets/")

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Credential Access

High

• Category: Privilege Escalation

Content

def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs use of scripts, packaging, filesystem operations, and hook examples, implying meaningful file and execution capabilities, but it declares no explicit tool scope or allowed-tools boundary. Without a declared scope, an agent may invoke broader tools than necessary when this skill triggers, increasing the blast radius of misuse or prompt-triggered overreach.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
version: "1.2.0"
name: skill-creator
description: Create, edit, improve, or audit AgentSkills. Use when creating a new skill from scratch or when asked to improve, review, audit, tidy up, or clean up an existing skill or SKILL.md file. Also use when editing or restructuring a skill directory (moving files to references/ or scripts/, removing stale content, validating against the AgentSkills spec). Triggers on phrases like "create a skill", "author a skill", "tidy up a skill", "improve this skill", "review the skill", "clean up the skill", "audit the skill".
---

# Skill Creator

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are broad and generic, such as 'improve this skill' or 'review the skill,' making accidental or overly frequent activation likely. Over-broad activation is dangerous here because the skill includes guidance for editing files, packaging outputs, and restructuring directories, which can steer an agent into side-effectful operations without sufficiently specific user intent.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

### Option 1: Check into Repository

For small teams, check skills into the repo (e.g., `./skills/` or `./.claude/skills`).

### Option 2: Plugin Marketplace

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```bash
# Create SKILL.md with template
cat > skills/my-new-skill/SKILL.md << 'EOF'
---
name: my-new-skill
description: [description]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger example "help me plan" is broad and can appear in ordinary conversation, which increases the chance that this skill activates when the user did not intend to invoke a structured multi-phase planning workflow. In a skill-creation context, overly broad activation can cause incorrect routing, unnecessary file access, or unintended modification/audit behavior across unrelated requests.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The manifest frames this skill as guidance for creating, improving, and auditing AgentSkills. The 'Memory & Storing Data' section introduces persistent data storage in locations like `~/.my-skill/data.json` or `${CLAUDE_PLUGIN_DATA}`, which is a broader operational capability not necessary for the core purpose of authoring or restructuring skill files.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The manifest describes a skill for creating, editing, improving, and auditing AgentSkills. The 'On Demand Hooks' section goes further by specifying runtime control behaviors such as blocking commands and restricting edits, which are capabilities of deployed skills rather than necessary functionality for authoring them.

Context-Inappropriate Capability

Low

• Confidence: 85% confidence
• Finding: A skill whose declared role is to create or audit AgentSkills does not inherently need to handle secrets-oriented configuration patterns. Recommending config files containing `api_key` and notification destinations expands into operational integration guidance that is not clearly covered by the manifest's narrower authoring-focused purpose.

Static analysis

No suspicious patterns detected.