Back to skill

Security audit

Seth Receitas Ptbr

Security checks for vulnerabilities and agentic risk

Overview

This recipe skill is mostly straightforward, but its advertised diet-restriction handling can return conflicting recipes, so it needs review before use.

Review this skill before using it for allergies, religious dietary rules, vegan/vegetarian meals, gluten-free, or lactose-free needs. Treat its recipes and nutrition data as suggestions only, because restrictions are not consistently enforced. Also expect recipe or ingredient queries to be sent to public recipe/nutrition APIs and cached locally.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (28)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
Undisclosed capability to fetch raw/HTML page content is more sensitive than high-level recipe lookup because it broadens the content surface and can introduce parsing, prompt-injection, or content-handling risks. When the description omits this, reviewers may underestimate the exposure created by arbitrary page retrieval.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
Undisclosed capability to fetch raw/HTML page content is more sensitive than high-level recipe lookup because it broadens the content surface and can introduce parsing, prompt-injection, or content-handling risks. When the description omits this, reviewers may underestimate the exposure created by arbitrary page retrieval.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
Undisclosed capability to fetch raw/HTML page content is more sensitive than high-level recipe lookup because it broadens the content surface and can introduce parsing, prompt-injection, or content-handling risks. When the description omits this, reviewers may underestimate the exposure created by arbitrary page retrieval.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
Undisclosed capability to fetch raw/HTML page content is more sensitive than high-level recipe lookup because it broadens the content surface and can introduce parsing, prompt-injection, or content-handling risks. When the description omits this, reviewers may underestimate the exposure created by arbitrary page retrieval.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
Undisclosed capability to fetch raw/HTML page content is more sensitive than high-level recipe lookup because it broadens the content surface and can introduce parsing, prompt-injection, or content-handling risks. When the description omits this, reviewers may underestimate the exposure created by arbitrary page retrieval.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
Undisclosed capability to fetch raw/HTML page content is more sensitive than high-level recipe lookup because it broadens the content surface and can introduce parsing, prompt-injection, or content-handling risks. When the description omits this, reviewers may underestimate the exposure created by arbitrary page retrieval.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
e = ing.get("measure", "").strip()
            name = ing.get("ingredient", "").strip()
            if measure and name:
                lines.append(f"  {i}. {measure} de {name}")
            elif name:
                lines.append(f"  {i}. {name}")
        lines.append("")
    
    # Instructions
    instructions = recipe.get("strInstructions", "")
    if instructions:
        lines.append("👨‍🍳 Modo de preparo:")
        # Split by capital letters or numbered steps
        steps = instructions.split("\r\n")
        for i, step in enumerate(steps, 1):
            step = sanitize_for_output(step)
            if step and len(step) > 5:
                lines.append(f"  {i}. {step}")
        lines.append("")
    
    # Tags
    tags_str = recipe.get("strTags", "")
    if tags_str:
        tags = [t.strip() for t in tags_str.split(",") if t.strip()]
        if tags:
            tag_icons = []
            for tag in tags:
                tag_lower = tag.lower()
                if "v
Confidence
80% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
A skill that appears to use file read, file write, and network capabilities without declaring any explicit tool scope violates least-privilege expectations and makes review harder. Even if the current purpose is benign, undeclared capabilities can enable unexpected data access or outbound requests if the implementation changes or if hidden functionality exists.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger list includes very common phrases such as ingredients, step-by-step, diet, shopping list, and what can I cook with ingredients, which can cause the skill to activate in many unrelated conversations. Over-broad activation increases the chance of unintended tool use, unexpected network access, or interception of queries that should be handled by other skills.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The file states that all recipes are returned in pt-BR, which imposes a language/locale constraint. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly justified as region-specific or the user is given a choice.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
This Python file contains natural-language strings indicating the skill is specifically for 'ptbr' and 'português do Brasil', and all CLI prompts are presented only in Portuguese. The policy requires flagging language/locale constraints when the skill forces a specific language without user opt-in, and this file does not present any language selection or justification for the restriction.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest describes a recipe skill focused on fetching pt-BR recipes from Wikilivros and TheMealDB and generating original recipes when needed. In this file, the skill initializes an OpenFoodFacts client and later exposes a dedicated `nutricao` command, which expands the behavior beyond recipe search/retrieval into nutritional data lookup from an additional source not mentioned in the manifest.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The file includes a hardcoded Portuguese-Brazil translation mapping and later applies it automatically to meal data. This imposes a specific language/locale behavior without any visible user selection mechanism or documented opt-in, which matches the language/locale policy violation criteria.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
This file encodes Portuguese-only dietary tags, measurements, ingredient variations, and Portuguese-specific parsing/output strings, which effectively forces a single language/locale. Under the policy, locale constraints should either be user-selectable or clearly documented as region-specific and justified.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest says the skill searches for recipes in pt-BR via Wikilivros and TheMealDB and generates original recipes when needed. This file implements a separate capability to query OpenFoodFacts for ingredient nutrition/allergen data, which is not mentioned in the manifest and is not part of the described recipe-source behavior.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The file contains multiple hard-coded Portuguese user-facing strings, such as error, nutrition, and test output messages. This imposes a specific language on users without any opt-in, fallback, or justification for a locale-specific constraint, which matches the language-policy violation criteria.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The parser detects recipe sections using hard-coded Portuguese terms such as 'ingredientes', 'modo de preparo', 'rendimento', and 'título', while also partially mixing in English terms. This imposes a language-specific behavior without any user opt-in or documented locale selection, which matches the policy category for forced language/locale behavior.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The class docstring states the generator produces "original Brazilian recipes," and the file consistently hardcodes recipe titles, ingredients, tags, and instructions in Portuguese. This creates a locale/language constraint in natural-language output without any opt-in or documented user choice, which matches the language-policy violation category.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The function advertises restriction-aware recipe generation, but multiple branches either ignore dietary flags entirely or route to generators that always emit animal products or dairy-containing steps. A user relying on vegan, vegetarian, lactose-free, or similar restrictions could receive contradictory instructions, creating health, allergy, religious, or ethical harm; in a food skill, incorrect dietary handling is more dangerous than a generic content mismatch because users may trust it for meal safety.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The module docstring states the client is specifically for pt.wikibooks.org, and the implementation reinforces this locale lock-in. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the restriction is clearly justified as region-specific.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The code sets `"language": "pt"` unconditionally, which enforces a specific language choice on users. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The manifest says the skill 'Busca receitas em português do Brasil (pt-BR) via Wikilivros + TheMealDB', implying a focus on pt-BR recipe retrieval. However, this cache shows searches returning and retaining broad unrelated content such as seafood, pork, beef, noodle, and international recipes in English, indicating the implemented behavior is general recipe aggregation rather than pt-BR-focused retrieval.

Natural-Language Policy Violations

Low
Confidence
93% confidence
Finding
A política pede sinalizar violações de idioma/localidade quando a skill impõe uma língua específica sem escolha do usuário. A linha descreve a skill como destinada a buscar receitas em português do Brasil, sem indicar opção de outro idioma ou consentimento explícito para essa restrição.

Missing User Warnings

Low
Confidence
89% confidence
Finding
Para arquivos markdown, deve haver aviso quando o comportamento pode afetar privacidade ou integridade do sistema. O README documenta uso de múltiplas APIs externas e informa que há cache local em `state/cache.json`, mas não traz um aviso claro ao usuário de que consultas/ingredientes podem ser enviados a serviços de terceiros e armazenados localmente.

Natural-Language Policy Violations

Low
Confidence
93% confidence
Finding
The package description explicitly states the skill is for fetching recipes in Brazilian Portuguese, which is a locale/language restriction expressed in natural language. There is no indication here that users can choose another language or that the constraint is presented as an opt-in preference.

Static analysis

No suspicious patterns detected.