Security audit

Android Mobpush Integration

Security checks for vulnerabilities and agentic risk

Overview

This MobPush integration skill is mostly purpose-aligned, but it unnecessarily persists and displays sensitive SDK credentials in project documentation and chat output.

Review this skill carefully before installing. Use it only on a disposable branch, require confirmation before file edits or Gradle commands, do not commit MobPush_Config.xlsx or MOBPUSH_README.md if they contain secrets, and prefer storing appKey/appSecret in ignored local properties or a secure secret manager instead of documentation files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill instructs generating a project README containing appKey, appSecret, and other private integration details. Storing secrets in a broadly readable documentation file increases the chance of accidental disclosure through source control, sharing, screenshots, or developer handoff, and those credentials could be abused to access or impersonate the push integration.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill explicitly tells the agent to write sensitive SDK credentials into a generated README without warning about exposure. This materially increases the likelihood of credential leakage because README files are commonly committed to repositories and shared with teammates, making the secrets far less controlled than necessary.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The workflow collects sensitive configuration values and then re-outputs them into build files and interactive responses. Even if some of these values must exist in app configuration, unnecessary echoing into chat output or generated content broadens exposure to logs, transcripts, and shoulder-surfing, increasing the chance of accidental disclosure.

Ssd 3

Medium

Confidence: 98% confidence
Finding: Creating a project README with SDK credentials and integration details is a direct secret-exposure issue because documentation files are often persistent, copied, and version-controlled. In this context, the skill is not just handling secrets for configuration but instructing the agent to duplicate them into an additional, unnecessary artifact, which compounds leakage risk.

Static analysis

No suspicious patterns detected.