Phy Deserialization Audit

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:03 AM UTC
• Version: 1.0.3

Overview

This is a local static-analysis skill for finding deserialization risks, with no evidence of hidden network use, persistence, credential access, or destructive behavior.

Reasonable to install for local source-code review, but expect to fix the documented Python snippet before relying on it. Run it only on repositories you intend to scan, since it reads source files to produce findings.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 567)May include surrounding context.

md

| `phy-jwt-auth-audit` | Auth + deserialization both present in API layers |
| `phy-cors-audit` | Network boundary misconfig + input handling risks |
| `phy-regex-audit` | Before deploying: full input-handling security sweep |
| `phy-env-doctor` | Ensure no deserialization keys/secrets in .env |

---

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation presents a usable standalone scanner, but the code initializes PATTERNS with calls to _build_js_patterns() at L252-L253 before that function is defined at L269. In Python, this raises a NameError during module import, so the documented implementation does not behave as the surrounding documentation implies.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md

("XSTREAM_FROM_XML",
         re.compile(r'\.fromXML\s*\('),
         CRITICAL, "CWE-502", "CVE-2021-29505",
         "XStream.fromXML() can execute arbitrary code via crafted XML.",
         "Upgrade XStream ≥1.4.18 and enable allowlist: xstream.addPermission(NoTypePermission.NONE)."),

        ("XML_DECODER",

Static analysis

No suspicious patterns detected.