Security audit

Skill Polisher

Security checks across malware telemetry and agentic risk

Overview

This is a local skill-quality tracker, but it needs Review because it persistently stores feedback and tracking data while repeatedly presenting itself as read-only.

Install only if you are comfortable with a local feedback tracker that stores ratings, comments, expectations, and tracking history on disk. Treat it as stateful, not fully read-only; avoid unusual skill names or --force, and prefer a version that validates skill names and clearly separates 'does not modify other skills' from 'does not write local data.'

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill repeatedly claims to be 'read-only' and 'not modify any skill files', but the documented behavior includes persistent writes to tracking, feedback, expectations, metrics, and history files. This mismatch is dangerous because users and higher-level agents may grant trust or invoke the skill under a false assumption of non-mutating behavior, leading to unintended data collection or state changes.

Intent-Code Divergence

Medium

Confidence: 82% confidence
Finding: The document describes the skill as read-only analysis, yet recommends adding a post-execution hook that invokes collect-feedback.py to gather and persist user feedback. This creates a hidden side effect: any adopting skill may begin collecting user data automatically, which can violate user expectations, privacy disclosures, and least-astonishment principles even if the data collection is not overtly malicious.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata explicitly claims '只读分析，不修改任何技能文件', but this script creates directories under the user's home directory and writes feedback JSON files. That mismatch is security-relevant because users and orchestrators may grant trust or approval based on a read-only claim, while the implementation performs persistent side effects and stores potentially sensitive comments on disk.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The file-level documentation presents feedback collection as routine behavior, but the broader skill description promises read-only analysis. This creates deceptive capability signaling: operators may invoke the skill in environments where writes are forbidden or unexpected, causing policy bypass, audit gaps, and unanticipated persistence of user-supplied data.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The script writes JSON expectation files under the workspace despite the skill metadata promising 'read-only analysis' and no modification of skill files. This creates a trust-boundary violation: operators may run the skill believing it is non-mutating, while it persists data to disk and can change workspace state without that expectation being explicit.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata promises 'read-only analysis', but this code creates directories under the user's home workspace with mkdir(parents=True, exist_ok=True). That is a real integrity/trust-boundary issue because users or higher-level automation may invoke the skill under the assumption that it performs no writes, causing unexpected filesystem modification.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: This function writes expectation data to disk and mutates the content with timestamps and skill metadata, directly contradicting the declared 'read-only' behavior. In an agent setting, misleading write capabilities are dangerous because they can violate least surprise, break policy assumptions, and be chained into unauthorized state persistence.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The module docstring explicitly advertises the tool as managing and editing expectations, which conflicts with the broader skill description claiming read-only analysis. While not code execution by itself, this inconsistency is a genuine security-relevant issue because operator trust, routing, and policy decisions may rely on the manifest description rather than hidden implementation details.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata explicitly claims the capability is read-only, but this code creates directories and writes persistent state to tracking.json under the user's home directory. That mismatch is security-relevant because users or higher-level policy may trust the skill not to modify state, and hidden persistence can enable unintended data retention or workflow manipulation.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The add/remove functions actively mutate skill-polisher state by changing the tracked skill list and appending history records, which contradicts the stated read-only analysis scope. In context, this is not arbitrary code execution, but it is still a trust-boundary violation because the skill can alter persistent behavior and future analyses without transparent disclosure.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.