Security audit

Skill Factory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent skill-building workflow, but it asks users to store API keys in package Markdown and can send skill content to third-party AI services without enough privacy and secret-handling guardrails.

Install only if you are comfortable with a skill that may call third-party AI services using your configured endpoints. Do not place live API keys in tech-library.md inside the skill package; use environment variables or a secret manager instead, and avoid sending confidential code, private documents, personal data, or embedded secrets to external providers unless you have reviewed and approved the exact endpoint and retention policy.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: tech-library.md:4
Finding: Insecure Storage and Exposure of External AI API Credentials
Content: View full analysis
| | api_key | | | api_key | | ``` The invocation guide instructs users to insert the credential directly into a command-line argument: ```bash curl -s /v1/chat/completions \ -H "Content-Type: application/json" \ -H "Authorization: Bearer " \ -d '{ "model": "", "messages": [ {"role": "system", "content": ""}, {"role": "user", "content": ""} ], "max_tokens": 4096, "temperature": 0.7 }' ``` The response-processing example repeats the same credential-handling pattern: ```bash RESPONSE=$(curl -s -m 30 /v1/chat/completions \ -H "Content-Type: application/json" \ -H "Authorization: Bearer " \ -d "${REQUEST_BODY}") ``` ### Technical Analysis The documented configuration workflow encourages users to place live API credentials in `tech-library.md`, a plaintext file inside the Skill directory. Although the file warns against public commits, the project does not prescribe an environment-variable mechanism, secret manager, ignored configuration file, restrictive permissions, or automated secret detection. A warning alone does not prevent the credential from entering source-control history ...[truncated 2257 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly directs actual third-party API calls and logging of each step's inputs, outputs, and failures, but it provides no notice, consent step, or data-handling guardrails for potentially sensitive user content. In this context, the danger is elevated because a skill-factory may process arbitrary source material from other skills, user requirements, test inputs, and benchmark artifacts, all of which may be transmitted to external providers and stored in logs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match ordinary requests about creating or improving a skill, which can cause this meta-skill to activate unexpectedly and take over conversations outside a narrowly intended context. Because this skill can generate and iterate on other skills, accidental invocation increases the chance of unsafe delegation, unintended workflow changes, or prompting the model into higher-risk meta-behavior without explicit user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide explicitly instructs routing prompts to external AI providers but does not warn that user data, prompts, or embedded secrets may be transmitted to third parties. In a skill-generation workflow, prompts can easily contain proprietary code, internal documents, or personal data, so omission of disclosure and handling rules creates a real privacy and data-governance risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The file provides a concrete curl template for sending system and user prompts to arbitrary external API endpoints using bearer credentials. Although presented as a configuration example, it normalizes external transmission of potentially sensitive task content without safeguards such as consent, redaction, endpoint allowlisting, or secret-handling guidance.
Content: Scanner excerpt · call-guide.md (reported line 93)May include surrounding context.
所有第三方 API 使用 OpenAI 兼容格式：

bash
curl -s <你的API地址>/v1/chat/completions \ -H "Content-Type: application/json" \ -H "Authorization: Bearer <你的API密钥>" \ -d '{

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file's natural-language instructions and warnings are entirely in Chinese, which can impose a fixed language on users without opt-in. The policy specifically flags language or locale constraints when the skill does not offer a user choice or document a justified regional scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.