Phy Rate Limit Audit

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:07 AM UTC
• Version: 1.0.3

Overview

This skill is a local static-analysis helper for finding missing rate limits and related resource-exhaustion risks, with no evidence of hidden execution, data exfiltration, or persistence.

Installers should understand that the tool reads source files under the path they choose and may produce false positives because it uses regex proximity checks. Treat findings as review prompts, especially for centralized middleware or abstracted frameworks, rather than automatic proof of vulnerability.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest description centers the skill on detecting missing rate limits on API endpoints. However, the implemented checks RL007, RL008, and RL009 analyze retry strategies, background queue/semaphore usage, and circuit-breaker or timeout protections, which go beyond rate-limiting semantics into general reliability and resource-management auditing.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The prose states the check finds email/SMS provider calls without a nearby guard and the sample output claims detection in a service file via caller-chain reasoning. In code, `check_rl003_email_sms_no_limit` does not traverse callers at all; it simply skips cases unless a local route-handler regex is present in nearby lines, which is a materially different behavior.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

severity="HIGH",
        location="<project>",
        message="No rate-limiting library imported anywhere in the codebase. All endpoints are unprotected.",
        attack="Unlimited requests — brute force, DoS, cost amplification attacks all possible.",
        cwe="CWE-400: Uncontrolled Resource Consumption",
        fix=(
            "JS: npm install express-rate-limit  |  "

• Confidence: 80% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Intent-Code Divergence

Low

• Confidence: 99% confidence
• Finding: The Quick Start and CLI help both describe verbose output, and `audit()` even accepts a `verbose` argument. But no code path changes output based on `verbose`, so the documentation promises behavior that the implementation does not provide.

Static analysis

No suspicious patterns detected.