Security audit

Thoth Pro

Security checks for vulnerabilities and agentic risk

Overview

This documentation skill is mostly purpose-aligned, but it deserves Review because it can expose raw project code and git history and modifies source by default.

Install only if you are comfortable putting selected source code and recent commit messages into the agent session. Use it on a clean working tree or copy of the repository, set `INJECT_DOCSTRINGS=no` unless you explicitly want source edits, consider `GENERATE_CHANGELOG=no` for private commit history, and install dependencies in a virtual environment rather than using `--break-system-packages`.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill explicitly prints up to 5,000 characters from each of the first 30 code files in the target project, which can expose proprietary source code, embedded secrets, credentials, or sensitive business logic to the model/session output. For a documentation tool, broad raw code disclosure is not necessary because the skill can analyze files locally and emit synthesized documentation instead.

Context-Inappropriate Capability

Low

Confidence: 92% confidence
Finding: The skill prints raw git commit history directly to output instead of only using it to build a changelog. Commit messages often contain internal ticket IDs, incident details, usernames, branch naming conventions, or other sensitive operational context that need not be exposed verbatim.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The instructions do not clearly warn users that the skill will read broad portions of the repository and print substantial source code and git history into the output stream. This undermines informed consent and increases the chance of accidental disclosure when used on private repositories.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill advertises docstring injection but does not provide a clear, prominent warning that source files may be modified as part of its operation. Silent or insufficiently disclosed source modification is risky because it can alter codebases unexpectedly, introduce incorrect content, and create integrity or review issues in version-controlled projects.

Static analysis

No suspicious patterns detected.