Security audit

社群收录

Security checks for vulnerabilities and agentic risk

Overview

The skill's community-intake workflow is mostly coherent, but it expands into installing a separate publishing tool, collecting platform credentials, and multi-platform publishing beyond the stated intake purpose.

Install only if you are comfortable with submitted community information being uploaded to an external IMA knowledge base and potentially shown in related directories. Do not use the publishing flow or curl-to-bash installer unless you separately trust that publisher tool and understand what credentials it will request and where it will post.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill’s stated purpose is community intake and syncing to an IMA knowledge base, but it later pivots into generating Skills and driving installation/use of a separate multi-platform publishing assistant. This materially expands scope from data collection to software installation and external publication, creating an unjustified escalation path that could expose user content or lead to unintended actions on third-party platforms.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill instructs users to run a remote shell installer via curl piped to bash for a separate publishing tool. This is dangerous because it executes unaudited remote code directly on the user’s system, and the action is unrelated to the core community-intake function, increasing the chance of social-engineering abuse.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill explicitly switches into a separate publisher workflow that collects platform credentials and performs multi-platform publication. For a community-registration skill, this is an unjustified privilege expansion that can lead users to disclose credentials or authorize actions they did not initially intend.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill advertises automatic synchronization of collected community information to an external IMA knowledge base, but it does not present a clear up-front privacy and data-transmission notice before starting collection. Users may provide information without understanding where it will be stored, who can access it, or that it leaves the local environment.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill contains detailed instructions to save and execute a Python script locally to upload data, but this local code-execution behavior is not clearly disclosed in the initial skill description or consent flow. Hidden or poorly disclosed execution steps increase the risk of users authorizing code execution they do not fully understand.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:342