Security audit

Kefir Batch Manager

Security checks for vulnerabilities and agentic risk

Overview

This is a local kefir tracking and recipe aid with overstated features and some fermentation safety gaps, but no evidence of hidden behavior, network access, credential use, or system-level persistence.

Before installing, treat this as a lightweight local batch tracker and calculator, not the full reminder/dashboard system described. Be careful with sealed second fermentation and bottle conditioning: use pressure-rated bottles, monitor carbonation, refrigerate before opening, and open away from your face. Expect local batch data to be written to kefir_batches.json.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The code does relate to kéfir batch tracking and fermentation records, so the overall domain is aligned. It supports cycle start/completion logic, simple ratio calculations, notes, quality ratings, and persistent history in a local JSON file. However, the declared description overstates the functionality in several material ways: there is no intelligent reminder or scheduling system, no grain health monitoring, and no recipe management. Additionally, although the class has methods for notes and completion, the command-line interface advertises commands like 'note' and 'complete' that are not actually implemented in the main command dispatcher. Therefore the description is only partially accurate and should be flagged as a mismatch due to materially missing declared capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code chunk is narrowly focused on calculations: ingredient ratios, estimated fermentation time, recipe scaling, grain growth estimation, and optimization for available grains. That partially aligns with the declared description's mention of calculating ratios. However, the declared purpose presents a broader 'comprehensive batch management system' with cycle tracking, reminders, health monitoring, and recipe/record management. None of those broader management capabilities appear in this code. There are no persistence mechanisms, reminder/scheduler integrations, tracking state, or health assessment logic. Therefore the description materially overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The Champagne-Style Kéfir recipe explicitly instructs users to add extra sugar and perform 7-day room-temperature bottle conditioning, producing a highly carbonated drink, but it does not clearly warn about pressure buildup, over-carbonation, or bottle rupture. In a fermentation-management skill aimed at practical use, omission of these safety instructions could plausibly lead to injury from exploding bottles or forceful release when opened.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guide recommends sealed second fermentation and priming sugar in pressure-rated bottles but omits any warning that carbonation can rapidly build dangerous pressure. In a food-fermentation troubleshooting guide, users may follow these steps directly; without instructions on burping, limiting time/temperature, refrigerating promptly, or opening carefully, there is a real bottle rupture and injury risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The section titled "Paris Water Considerations" presents location-specific guidance as part of the skill's specialized knowledge without indicating that it is optional or only applicable to users in Paris. This creates a locale-specific bias in the skill description that may not fit users in other regions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The JSON template includes French-language strings such as "Standard Kéfir de Fruits" and "Template for kéfir batch tracking" with accented terminology embedded as defaults. Because this file applies to all users of the template and offers no language choice or documented region-specific reason, it can be interpreted as forcing a locale/language convention without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The title and description use accented 'Kéfir' terminology, indicating a specific language/locale convention, but the file does not explain that this is region-specific or offer alternatives. Under the stated policy, forcing a locale convention without opt-in can be a natural-language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module title and description use accented terms ('Kéfir', 'kéfir') that impose a specific language/locale presentation without offering any user choice or documenting a locale requirement. This matches the policy category for language or locale constraints that are not optional or justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file title and class docstring use the localized spelling "Kéfir" in user-facing natural language, and the CLI banner repeats that wording. Under the stated policy, forcing a specific language or locale without user opt-in can be a natural-language policy issue. There is no indication that the tool is region-specific or that users can choose localization.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.