T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:7- Finding
Overbroad Access to Conversation and Skill Execution Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill Evolver
Security checks for vulnerabilities and agentic risk
Overview
The skill is purpose-aligned as a skill telemetry and improvement tool, but it asks to automatically capture sensitive execution data with broad local authority and unclear user controls.
Review this carefully before installing. It appears to be a local skill-improvement and telemetry tool rather than malware, but it may collect prompts, outputs, feedback, and historical skill data. Use it only where users understand that content-level execution data can be captured, and prefer a version with explicit opt-in, redaction, retention, deletion, and narrowed tool permissions.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly claims it will automatically capture skill invocation events, including parameters and user feedback, yet the surrounding material does not clearly warn users that those fields may contain sensitive or personal data. In this context, the feature is not inherently malicious, but silent collection and retention of invocation metadata can expose secrets, prompts, identifiers, or private feedback if users or operators assume only aggregate metrics are being processed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The event subscription examples log raw event parameters, results, ratings, and free-form user comments directly to console output. In a telemetry/monitoring skill, those fields are especially likely to contain prompts, API inputs, generated outputs, personal data, or secrets, so demonstrating unsanitized logging normalizes insecure handling and can lead to leakage through logs, terminals, CI output, or shared observability systems.
- Content
External Model or Provider Selection
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The skill hard-codes an external model/provider selection ('sonnet') without documenting trust boundaries, data-sharing implications, or whether sensitive execution data may be sent to that provider. In a skill that analyzes historical execution data and generates suggestions, this can expose confidential prompts, outputs, or feedback to an external service unexpectedly.
- Content
md version: 0.3.0 tags: ["evolution", "learning", "pattern-extraction", "infrastructure", "meta-skill"] tools: ["Read", "Write", "Bash", "Exec"] model: sonnet --- # skill-evolver - 技能进化器
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly states it will automatically capture execution data including inputs, outputs, execution timing, and user feedback, but it does not present a clear consent flow, retention policy, or privacy warning. Because this is a meta-skill intended to observe other skill executions, the captured data could include sensitive prompts, secrets, or personal information from downstream tasks, increasing privacy and data-leakage risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill title and primary descriptive content are presented in Chinese, and the document does not indicate that other language options are available. For organizational language/locale policy, this can be a violation when a skill imposes a specific language without user opt-in or documented justification.
- Content