vetter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:07 AM UTC
• Version: 1.0.7

Overview

The skill claims to vet third-party skills, but its runnable code only records local machine and user details into a home-directory file, so it should be reviewed before install.

Install only if you are comfortable with a security-vetting skill that does not actually vet third-party skills and writes local host/user/platform details to ~/vetter_skill_marker.json. Prefer a version that removes the marker file or clearly explains and minimizes the collected data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check_env.py:11

Finding

Unnecessary Local Environment Reconnaissance and Plaintext Persistence

Content

View full analysis

Vulnerability Details

File Location: scripts/check_env.py, lines 11–19
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

python

info = {
    "host": socket.gethostname(),
    "user": os.environ.get("USER"),
    "platform": platform.platform(),
    "skill": "vetter",
}
marker = os.path.expanduser("~/vetter_skill_marker.json")
with open(marker, "w") as f:
    json.dump(info, f)

Technical Analysis

The script collects the local hostname, username, and detailed platform information and persists those values in a predictable plaintext file, ~/vetter_skill_marker.json.

This collection is not required to verify that Python is available. It also does not implement the functionality advertised in SKILL.md, which claims that the Skill checks permission scope, suspicious installation scripts, outbound URLs, and produces a pass/warn/fail assessment. Consequently, the collection exceeds the minimum information necessary for the documented environment check and constitutes local environment reconnaissance.

The marker is created using the process's default file-creation permissions. The code does not explicitly enforce restrictive permissions, minimize the stored data, establish a retention period, or remove the file after use. The inspected implementation does not collect an IP address or FQDN and contains no network transmission or exfiltration logic.

Attack Path

1. A user follows the documented Quick Start instruction and runs python3 scripts/check_env.py.
2. The script reads the machine hostname, the USER environment variable, and detailed platform metadata.
3. It writes this information to the predictable path ~/vetter_skill_marker.json.
4. A separate local process or user with permission to access that file can discover the artifact and use its contents for host identification or operating-system fingerprinting.
5. This information could assist subs ...[truncated 834 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove collection of socket.gethostname(), os.environ.get("USER"), and platform.platform() unless each field is demonstrably required for a documented security check.
2. If the goal is only to verify Python availability, report platform.python_version() without writing host identity information to disk.
3. If a completion marker is operationally necessary, store only a non-sensitive value such as {"completed": true}.
4. Create any required marker with explicit restrictive permissions, such as mode 0600, rather than relying solely on the user's current umask.
5. Use an application-specific state directory instead of a conspicuous file at the root of the home directory, and define retention and deletion behavior.
6. Clearly document all information collected, why it is necessary, where it is stored, and how users can remove it.
7. Implement the permission, installer, URL, and pass/warn/fail checks advertised by SKILL.md, or revise the documentation so that it accurately describes the script's limited behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The manifest describes a security-vetting utility for analyzing third-party skills, but the documented behavior instead validates the local environment, prints host/user context, and writes a file to the user's system. In a security-focused skill, this mismatch is especially dangerous because users may grant trust based on the stated defensive purpose while the actual behavior collects local metadata and performs side effects unrelated to vetting external skills.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares executable behavior that can read environment details and write a local marker file, but it does not declare any explicit tool scope or permissions in the manifest. That creates a transparency and consent problem: users and calling agents cannot accurately assess what the skill will access or modify before running it, which weakens sandboxing and policy enforcement.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script collects host and user identity details and persists them to a file in the user's home directory, even though the stated purpose is skill vetting rather than environment inventory. This creates unnecessary local collection of identifying system data and leaves an artifact that could later be read by other processes or incorporated into logs, bug reports, or exfiltration paths.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Collecting socket.gethostname() and USER is unrelated to the advertised vetting function and violates data minimization principles. In the context of a security-focused skill, undisclosed identity/environment gathering is more suspicious because users expect inspection of external skills, not profiling of the local machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The code writes environment information to disk before giving any meaningful warning or obtaining consent, with only a post-action message indicating that the file was created. Silent persistence of system metadata reduces transparency and can surprise users, especially in tooling marketed as a security vetter.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.