Security audit

Auto-Optimizer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent optimizer, but it gives an agent broad authority to edit files, create git commits, and run local commands with weak user-control guardrails.

Install only if you are comfortable with an agent editing explicitly selected files and running local metric commands. Use a disposable branch or copy, avoid git add . on real projects, inspect the metric command before running it, review diffs before accepting results, and delete saved result folders if they contain private prompts, code, copy, or strategy data.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: The MiroFish section extends the skill from local optimization into networked simulation orchestration against a localhost API, including project listing, simulation creation, and status retrieval. This broadens the attack surface and operational scope beyond the stated purpose, which can surprise users and enable unintended access to local services or data flows not expected from an optimizer skill.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup guide instructs users to run `git init && git add . && git commit -m "baseline"` on their project without any warning that this will snapshot all current files and modify repository history. This can accidentally commit secrets, proprietary data, or unrelated work, and it normalizes a potentially destructive action as a prerequisite for using the skill.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The agent-specific instructions tell AI agents to automatically initialize a git repository and commit all files if one does not already exist, with no user approval step. In an autonomous agent context this is more dangerous because it can silently alter project state, capture sensitive files, and create irreversible side effects without informed consent.

Vague Triggers

High

Confidence: 94% confidence
Finding: The activation phrases are extremely broad, covering common requests like 'optimize', 'improve', 'make better', and 'benchmark', so the skill may trigger during ordinary conversations where the user did not intend autonomous file modification or looped execution. Because this skill can run scripts, mutate artifacts, and revert via git, accidental activation materially raises the chance of unsafe or unauthorized actions.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The top-level description emphasizes 'zero-friction' optimization and fast results but does not clearly warn that the skill will modify files and automatically keep or revert changes using git. This omission undermines informed consent and can cause users to invoke the skill without realizing it may alter repository state or local artifacts.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The script executes the user-provided --metric value with eval, which allows arbitrary shell command execution in the current environment. In this skill's context, the command is not just configurable but actively encouraged through wizard and demo flows, making accidental or adversarial command injection highly plausible and capable of running destructive commands, exfiltrating data, or modifying the repository.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The optimizer writes AI-generated content directly back to the target file during each iteration, but the tool does not present a prominent upfront warning that it will overwrite user files repeatedly. Although git is used for rollback, this behavior can still cause loss of uncommitted work, unintended modification of sensitive files, or propagation of harmful/generated content into a working tree without informed consent.

Static analysis

No suspicious patterns detected.