Security audit

archive-smart-reader

Security checks for vulnerabilities and agentic risk

Overview

This archive-reading skill is not clearly malicious, but it needs Review because it can modify the environment, run locally discovered archive tools, extract files, and keep persistent usage records without enough user control.

Install only if you are comfortable with a skill that may install Python packages, use Bash, write extracted files, run locally found unrar/7z tools, and keep a local learning file. Prefer manually installing trusted archive tools, avoid extracting untrusted archives into sensitive directories, and periodically inspect or delete ~/.workbuddy/skills/archive-smart-reader/learned_patterns.json.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill's stated archive-reading purpose is expanded with persistent behavioral logging and filesystem probing for external executables in user-accessible locations. Those extra behaviors increase privacy and supply-chain risk because they touch unrelated host state and may invoke untrusted binaries outside the archive-processing core.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Automatic dependency installation is dangerous because it converts a read/extract utility into a package-installing tool with code execution side effects. If triggered automatically, it can install unexpected software, alter the environment, and expose the user to package-repository or typosquatting risks.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The claimed automatic learning system creates persistent state unrelated to the minimum function of reading archives. Storing usage patterns, paths, and error history over time can expose sensitive data and expands the attack surface without clear necessity.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The file records persistent cross-run learning and host-specific operational details that go beyond a simple archive reader’s stated purpose. Persisting behavioral state and environment-specific tool knowledge expands the skill’s scope, can leak host characteristics, and creates an implicit memory mechanism that may be abused or operate without clear user consent.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill is designed as a reader, yet it learns to search for and configure external executables such as unrar/7z from host-specific locations. Automatically discovering and invoking binaries from writable or user-controlled paths increases the risk of executing a trojanized tool, leading to arbitrary code execution in the host environment.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The RAR helper automatically searches for and configures external executables from user-writable locations such as Downloads and Temp, then later uses them for archive extraction. This creates an executable trust problem: an attacker who can place a malicious unrar/7z binary in one of those locations may gain code execution when the skill handles a RAR archive.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Overly broad trigger phrases can cause the skill to activate unintentionally in unrelated conversations. Because this skill can read/write files and run Bash, accidental invocation raises the risk of unintended filesystem access or archive extraction actions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill advertises automatic learning with persistent storage but does not give a strong privacy notice or explicit consent flow. In context, this is more dangerous because archive contents and filenames often contain sensitive project, personal, or credential-related information.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Documenting automatic dependency installation without a user-confirmation step normalizes environment-modifying behavior in a skill that should mainly inspect archives. That creates avoidable trust and execution risks, especially where package installation may run with user privileges and network access.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Persistent logging of operations, errors, formats, and paths can accumulate sensitive metadata about the user's archives and activity history. Even if intended for optimization, this creates a privacy exposure and potential local information disclosure if the file is accessed by other tools or users.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The workflow explicitly says each operation is recorded after extraction, creating a durable audit trail of user actions and accessed archive contents. In an archive-reader context, that can reveal sensitive filenames, destinations, and behavioral patterns unrelated to the immediate user request.

Static analysis

No suspicious patterns detected.