Security audit

code-simplifier

Security checks for vulnerabilities and agentic risk

Overview

This skill gives behavior-preserving code refactoring guidance with broad activation phrases, but it does not contain hidden installation, credential access, persistence, or exfiltration behavior.

This skill is reasonable to install for refactoring help, but users should be explicit about the files or functions they want simplified, review diffs before accepting changes, and treat any git commit as a separate user-approved action.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The English trigger phrases such as 'simplify this code', 'refactor this', and 'make this cleaner' are extremely broad and likely to match ordinary coding requests that do not explicitly request this specific skill. In an agentic system, overly generic activation conditions can cause unintended invocation, expanding the skill's operational scope and increasing the chance it runs in the wrong context.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The Chinese trigger phrases are also broad and ambiguous, for example requests equivalent to 'simplify code' or 'optimize code structure', which can naturally occur in many normal development conversations. This makes accidental or overbroad skill activation more likely, especially in multilingual environments where trigger matching may already be less precise.

Static analysis

No suspicious patterns detected.