Security audit

Local Find Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Markdown-only skill finder, but it gives itself mandatory routing priority and steers users through specific skill registries before installation.

Review this before installing if you do not want a skill to prioritize external skill discovery flows automatically. Ask the agent to show the registry, package name, version, publisher, and risk summary before any install, and choose the registry yourself when source provenance matters.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:3
Finding: Mandatory Priority Rules Hijack Agent Routing for Skill Discovery and Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The metadata description bakes in locale-based routing for Chinese users, preferring a specific source without explicit user choice. Selecting registries based on language or network geography can silently alter the trust boundary, repository provenance, and compliance posture for users who were not asked which source they prefer.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow mandates source selection based on user language and CN network conditions, with automatic fallback behavior, but does not offer informed consent or an opt-out. This can steer users toward different ecosystems and package sources than they expect, which matters in a skill-installation context because repository choice affects supply-chain risk, version availability, and auditability.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger logic is broad enough that ordinary help requests can be re-routed into a skill discovery/install workflow even when the user did not clearly ask to search for or install a skill. That creates a prompt-routing and least-surprise problem: users may be pushed toward external package discovery and installation unnecessarily, increasing the chance of unneeded third-party exposure or accidental installs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.