Security audit

Code Assistant

Security checks for vulnerabilities and agentic risk

Overview

This is a local code-analysis helper with some overstated documentation, but I found no hidden persistence, exfiltration, destructive behavior, or privilege escalation.

Review the scope claims before relying on this skill: its actual analyzer appears read-only and local, but the documentation overpromises refactoring, tests, agent delegation, and self-repair. Use it on projects under version control, and treat any future auto-fix or refactor feature as requiring explicit review before accepting file changes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: La descripción coincide parcialmente con el comportamiento: el código sí analiza archivos fuente, busca ciertos bugs, sugiere algunas optimizaciones y genera documentación básica. Sin embargo, hay diferencias materiales. La capacidad de refactorizar está declarada pero no está implementada; de hecho, el campo `refactorings` siempre se devuelve vacío. Además, la documentación generada es un esqueleto simple basado en firmas de funciones, no una documentación automática completa. Por último, el código se comporta como una utilidad CLI local de análisis estático con reglas heurísticas limitadas, no como un asistente de programación general. No se observan permisos ocultos ni acceso a recursos inesperados más allá de leer archivos y recorrer directorios locales, que son consistentes con el análisis de código.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises capabilities that can interact with codebases and mentions environment-related capability detection, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, missing scope declarations can lead to overbroad access assumptions and unsafe execution of code-analysis or modification tasks against sensitive files or environment data.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill describes refactoring, formatting, extraction, and other code-changing actions without a prominent warning that project files may be modified. In practice, users may invoke these commands expecting advisory output and unintentionally authorize destructive or broad changes to source code, configuration, or tests.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Documenting `CODE_AUTO_FIX` and `self-repair` without a clear safety warning increases the risk of silent or poorly understood automatic code changes. In a coding-agent context, this is more dangerous because autonomous fixes can propagate insecure edits, break builds, alter tests, or modify critical project files at scale.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The file describes the assistant as an "Asistente de programación especializado," and the user-facing CLI strings throughout the file are exclusively in Spanish. This imposes a language choice in natural-language output without offering any user selection or opt-in, which matches the locale/language policy violation criteria.

Static analysis

No suspicious patterns detected.