Security audit

SKILL.md 优化工具

Security checks across malware telemetry and agentic risk

Overview

This SKILL.md optimizer mostly performs document editing, but it also requires unrelated RedFox credential guidance and automatic usage reporting to an external service.

Review carefully before installing. This skill can edit SKILL.md files and is designed to call an external RedFox reporting endpoint after use, using a bundled API key or your REDFOX_API_KEY. Install only if you are comfortable with that telemetry and with the RedFox API key guidance being inserted into optimized skill documents.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill describes and requires capabilities beyond simple document editing, including environment-variable access and outbound network use, yet it declares no permissions or equivalent disclosure. This creates hidden side effects and prevents users or platforms from making an informed trust decision before invocation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented purpose is optimizing SKILL.md files, but the content also directs execution of a telemetry/reporting script that sends data to an external service using a built-in or environment-provided API key. This behavior mismatch is dangerous because users invoking a text-optimization skill would not reasonably expect credential use and external reporting.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill claims it only optimizes SKILL.md, but it instructs the agent to execute an additional script after completion to report usage. This introduces non-essential code execution and outbound data transfer unrelated to the user’s requested task, increasing privacy and supply-chain risk.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: A document-formatting skill contains instructions to insert authentication guidance, rely on a shared built-in API key, and prioritize that key for script execution. Embedding credential and usage-recording behavior into a text-optimization workflow is disproportionate to the stated purpose and can normalize unsafe key handling and hidden service coupling.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The skill states a hard constraint of only modifying SKILL.md, yet elsewhere instructs moving content to references/, relocating sections to README.md, and executing a script. These contradictions make the skill’s actual write and execution scope unpredictable, increasing the risk of unauthorized file changes and unexpected side effects.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The script implements outbound telemetry to a third-party endpoint every time the skill is used, even though the skill is described as a local SKILL.md optimization tool. This creates a hidden data-flow and trust-boundary violation: using the skill causes network communication unrelated to the stated functionality, which can expose usage metadata and surprise users or operators.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code embeds a built-in API key and also reads an environment API key for external reporting, giving a document-formatting skill unnecessary credential-handling and exfiltration capability. Hardcoded secrets are themselves a security issue, and combining them with network transmission materially increases the risk of unauthorized service use, secret leakage, and abuse outside the expected scope of the skill.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill is triggered by generic natural-language requests such as 'describe your optimization need,' without clearly limiting itself to SKILL.md files or excluding adjacent documentation-editing tasks. This can cause over-broad activation, where the agent selects this skill in unintended contexts and performs document transformations outside its intended scope.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The example prompts are broad enough to overlap with ordinary editing or review requests, which increases the chance this skill will match unrelated tasks. In agent-routing systems, ambiguous examples can bias selection and lead to incorrect tool invocation, unintended file edits, or interference with more appropriate skills.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill advertises activation through broad natural-language requests such as '直接用自然语言描述你的优化需求即可', without defining clear scope boundaries like requiring explicit mention of SKILL.md or optimization intent. In an agent environment, this can cause unintended invocation on ordinary editing or review requests, leading to incorrect tool selection, prompt routing, or unintended file modifications.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The example trigger phrases are generic user utterances like '检查一下这个 SKILL.md 是否符合标准格式' and similar common editing requests, with limited disambiguation beyond the file name. If an orchestration layer uses semantic matching, these broad examples can over-match routine documentation tasks and activate this skill when the user did not intend structured skill optimization.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger phrases are broad enough that the skill may activate in contexts where the user did not clearly request this specific behavior. Because the skill can modify files and includes additional non-core behaviors, accidental invocation raises the chance of unintended edits or reporting.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill directs writing changes to the target SKILL.md without a clear upfront warning that user files will be modified. Silent or implicit write behavior can lead to accidental overwrites, especially when the skill may be triggered by broad phrasing.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill includes automatic usage reporting to an external service without a clear user-facing warning or opt-in. Hidden network behavior combined with credential use creates privacy, compliance, and trust risks, especially in a skill whose stated purpose is local document optimization.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script reads REDFOX_API_KEY and sends usage data without any interactive warning, confirmation, or obvious opt-in in the execution path. Even if the transmitted payload is small, silently consuming locally available credentials for a remote service is inappropriate for a formatting skill and can violate user expectations, privacy requirements, and deployment policies.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/record.py:30