Security audit

Etalon Tech Scan

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed website technology scanner, with some install and credential-handling cautions but no evidence of hidden or malicious behavior.

Install only the ETALON CLI version you trust, preferably a pinned release, and do not run installs with elevated privileges. Confirm each scan target yourself, be careful with bulk scans, and avoid putting database passwords directly in command-line arguments; use a protected environment variable or secret store if supported.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:172
Finding: Unpinned Installation of an Executable Third-Party Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:187
Finding: Database Credentials May Be Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest includes a scenario trigger phrased as "Human asks what tech stack a website uses," which is broad and lacks explicit boundaries or exclusions. Unlike the concrete trigger list above, this natural-language condition could overlap with casual conversation and does not specify when the skill should not activate.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The trigger "Human is evaluating a competitor" is very general and does not clearly indicate that the user must be asking for a website tech scan. This ambiguity increases the chance the skill is invoked during broader business discussions that are not intended to initiate scanning behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The phrase "Human is doing due diligence on a startup" is not specific to technology detection and could apply to many non-technical evaluation contexts. Without limiting conditions, it is unclear when this skill should activate versus when another skill or no skill should be used.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The trigger "Human mentions migrating tech or choosing a stack" is expansive and could match many routine planning conversations without any intent to scan a reference domain. The manifest does not provide negative examples or constraints to distinguish casual mention from deliberate invocation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.