Security audit
Skill Discoverer
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to be a simple recommendation helper, but it asks for file-writing and command-running powers that its artifacts do not justify.
Review before installing. The visible code looks benign, but prefer a version that removes Write, Bash, and Exec or clearly limits them to explicit user-approved actions. Treat the advertised vector search and automatic optimization claims as overstated for this version, which appears to use simple rule-based matching.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.