Security audit

File Indexer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local file-metadata indexer with disclosed scope and no evidence of exfiltration, deception, or destructive behavior.

Install only if you are comfortable keeping a local searchable catalog of filenames, paths, sizes, and dates from your Documents and Downloads folders. Consider tightening catalog file permissions and avoiding ambiguous use of the broad "where is" trigger.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Note

Location: scripts/indexer.py:99
Finding: File Symlinks Can Bypass the Allowed-Root Metadata Boundary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/indexer.py:56
Finding: Metadata Catalog Files Are Created Without Explicit Restrictive Permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill describes executable commands that read from and write to the local filesystem and store a SQLite database, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, missing scope declarations can let the skill be invoked with broader-than-intended file access, undermining the documented claims about allowed roots and blocked directories if those constraints are not enforced by the platform.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrase "where is" is broad and can match many ordinary user requests unrelated to filesystem indexing, increasing the chance that this skill is activated unexpectedly. That can cause unintended enumeration of local files and metadata disclosure, especially because the skill is designed to search across user directories and return paths, dates, and sizes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.