Security audit

vetter

Security checks for vulnerabilities and agentic risk

Overview

This skill presents itself as a security vetter, but the included executable only records local environment details and does not actually inspect other skills.

Review this skill carefully before installing. It does not appear to perform the promised third-party skill security review, and running its script creates a local file in your home directory containing your hostname and username. There is no evidence of network exfiltration or destructive behavior in the inspected files, but the purpose mismatch and unnecessary local identity recording warrant Review.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares no permissions, yet its documented behavior includes reading environment information and writing a local marker file. This creates a transparency and trust problem: users and platforms cannot accurately evaluate what the skill will access or modify before running it, which is especially risky for a security-focused vetting skill that should minimize and clearly disclose side effects.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The stated purpose is to vet third-party skills for risky permissions and suspicious patterns, but the documented behavior instead performs a local environment check, gathers host/user details, and writes environment-derived data to disk. This mismatch is dangerous because it can mislead users into trusting and executing the skill under a false security pretense, while it performs unrelated host inspection and persistence-like side effects.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The script writes host and user metadata to a persistent file in the user's home directory even though the stated purpose is only an environment check for a vetting skill. Persisting identity and host details creates unnecessary local data exposure and can support fingerprinting or later collection by other components, especially because the data collection is not clearly required for the advertised function.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code collects local hostname and username information without a clear need tied to skill vetting, which exceeds the minimum data required for an environment check. In the context of an install-time skill, unnecessary host identity collection is more concerning because users may run it with trust, and the data could be used for profiling, correlation, or future exfiltration.

Intent-Code Divergence

Low

Confidence: 83% confidence
Finding: The docstring presents the script as a simple environment check, but the implementation also stores environment metadata to disk, creating a mismatch between description and behavior. This weak transparency is dangerous because users reviewing the skill may underestimate what it records, reducing informed consent and making suspicious behavior easier to hide.

Static analysis

No suspicious patterns detected.