Security audit

Firm Delivery Export

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent delivery/export purpose, but it asks for broad service credentials and shell/network access across formats, including outputs that do not need them.

Review before installing. Use fine-grained, repository- or project-limited tokens, avoid exposing unrelated Jira/Linear/GitHub credentials for local exports, and verify generated PRs or tickets are drafts and clearly labeled for human review before relying on the workflow.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:10
Finding: Overprivileged Credential and Shell Access Across Export Formats
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill claims all GitHub PRs are created as drafts by default, but the published schema exposes a user-controlled draft field with no documented enforcement. In a delivery/export skill that turns agent output into real repository actions, this mismatch can cause non-draft PRs to be created and treated as ready for review or accidental merge, weakening the stated human-review safeguard.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill states that a needs-review label is applied unconditionally, but the schema allows arbitrary labels and does not document mandatory enforcement of that label. Because this skill publishes agent-generated content into team tooling, missing or replaceable review markers can make AI-generated deliverables appear fully trusted and bypass expected human scrutiny.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The support text switches to French ('Si ce skill vous est utile, vous pouvez soutenir le développement') without offering a language choice or explaining a locale-specific requirement. This is a natural-language locale policy issue because the skill content imposes a specific language in a general-purpose document.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.