Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > 📎 **Code example 1** (typescript) — see [references/examples.md](references/examples.md)
Security audit
error-detective
Security checks for vulnerabilities and agentic risk
Overview
This is a debugging helper skill whose examples touch sensitive diagnostic context, but the behavior is disclosed enough and aligned with its purpose.
Install/use this for debugging workflows only. If you copy the TypeScript example into a project, restrict file reads to the intended project directory, review any metrics endpoint before enabling telemetry, and avoid sending stack traces, source snippets, source maps, or host metadata to third parties without consent.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > 📎 **Code example 1** (typescript) — see [references/examples.md](references/examples.md)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description is very broad and can cause the agent to invoke this skill in loosely related situations beyond strict debugging or incident-analysis tasks. Overly permissive trigger language increases the chance of inappropriate routing, which can expose unrelated user data to the skill context or produce unreliable behavior in workflows that depend on precise skill selection.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example instantiates a MetricsCollector with a configurable metrics endpoint, introducing outbound telemetry capability that is not clearly necessary for a debugging-focused skill example. Even though the sample does not show the network send implementation, this creates a path for error metadata and potentially sensitive diagnostic details to be exfiltrated to a remote service if implemented or copied into production.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example collects host environment details such as Node version, platform, architecture, memory usage, and uptime without disclosing that potentially sensitive host metadata is being gathered. While such data can aid debugging, it also supports fingerprinting and may reveal operational characteristics that should not be exposed, especially if later logged, reported, or sent to telemetry services.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code reads local files directly from stack frame-derived file paths using fs.readFile, which can expose arbitrary source code and nearby sensitive files if attacker-influenced error objects or stack traces are processed. In a debugging skill, local code inspection may be relevant, but unrestricted path use exceeds the stated purpose and can leak secrets, proprietary code, or host-specific data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The markdown example automatically reads both source files and source maps from local disk without any user-facing disclosure. Source maps can reveal original source structure, internal paths, and code that may not be intended for exposure, so combining them with arbitrary file reads materially increases host-data leakage risk.
- Content