Security audit

SignPath

Security checks for vulnerabilities and agentic risk

Overview

This SignPath skill is mostly transparent, but it labels a signing action as if it were safe/read-only, which could let an agent submit a sensitive signing request without proper confirmation.

Review before installing or using this skill. It should be treated as capable of submitting SignPath signing requests, not just reading SignPath data. Require explicit confirmation of the exact payload, signing policy, project, and expected effect before any `fast_sign_hash` run.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill metadata says it is for 'searching and reading data,' but the documented `fast_sign_hash` action submits a signing request, which changes external state and can trigger sensitive signing workflows. This mismatch can mislead an agent or user into invoking a write-like operation without the scrutiny and confirmation normally required for state-changing actions.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The safety section states that untagged actions are reads, but `fast_sign_hash` is untagged even though it submits a signing request and changes state. In an agent setting, this misclassification is especially dangerous because it can cause the agent to execute a sensitive signing action automatically under the assumption that it is safe and read-only.

Static analysis

No suspicious patterns detected.