Security audit

Handover Sync

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed documentation handoff workflow that reads repository state and updates project docs, with no evidence of hidden execution, exfiltration, or system persistence.

Install this if you want an agent to update project handoff docs from repo evidence. Before running it, be clear whether it may edit only handover.md or also README and nearby TODO/runbook notes, because the default workflow updates related documentation together.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README states that the skill will, by default, synchronize multiple documents including handover.md, README.md, and related TODO/runbook files, but does not prominently warn users that invoking the skill may modify several repository files automatically. In this context, that behavior increases the risk of unintended or overbroad edits, especially when combined with conversational trigger phrases and when users may expect only a summary rather than write actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The example trigger phrases are broad, natural-language requests such as summarizing today's work or updating handoff docs, which can match routine conversation and cause the skill to activate when the user did not explicitly intend repository-modifying behavior. In this skill's context, unintended activation is more concerning because the documented workflow includes reading repo state and potentially updating multiple files, so an ambiguous trigger can lead to unexpected documentation changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file declares English as the default structure without an explicit user-choice mechanism, which can override user language preference or conflict with the skill metadata promising Chinese or English. While not a direct security exploit, this is a control/intent mismatch that can cause the agent to ignore user expectations and apply the wrong output mode.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The opening examples instruct the agent to 'follow this structure' for broad requests, but they do not define clear boundaries for when the skill should activate versus when it should merely answer conversationally. That ambiguity can lead to unintended scope expansion, including updating multiple docs by default even when the user only asked for a simple recap.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrase guidance includes very generic language such as requests to summarize work or update a handover, which can match ordinary conversation without enough gating conditions. In a skill system, overly broad activation can cause the agent to enter this workflow unexpectedly and modify project documentation when the user did not clearly request that specific action.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The template is entirely written as a Chinese-only instruction set and does not offer the user any language or locale choice. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is clearly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The template defines automatic activation for broad intents like 'summarize what we did today', 'update handoff docs', or 'write down problems and next steps'. These are common requests that may appear in ordinary conversation, so the skill can trigger unexpectedly and take over document-updating behavior without an explicit, narrow invocation boundary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The recommended phrases are short, natural-language requests that lack constraints and are easy to match accidentally. Because they imply multi-file updates, ambiguous invocation can cause unintended edits to project documentation, which is especially risky in an agent skill that transforms repository state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file states that the skill will 'update the handoff docs together by default' and, unless narrowed, updates handover.md, README sections, and nearby notes. Because the description documents automatic file modifications but does not include any user warning about editing repository files, it fits the markdown-specific missing user warnings category.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.