Security audit

Chatmosp File Organizer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a project file organizer with some documentation inconsistencies, but no evidence of hidden, destructive, credential-seeking, or exfiltration behavior.

Install only if you are comfortable with a skill that creates and organizes files under the ChatMOSP OUTPUT directory. Before relying on it, clarify whether KMC tasks should always live under an MSR directory or may sometimes be top-level OUTPUT tasks; also treat the Unicode-control signal as a benign UTF-8 BOM in these files, not as evidence of hidden instructions.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The skill defines conflicting rules for KMC directory placement: one section says KMC directories must be subdirectories of the corresponding MSR task, while a later section allows a direct KMC mode at the OUTPUT root. In a file-management skill, this ambiguity can cause downstream agents to create or read from the wrong path, breaking trust assumptions around file isolation and increasing the chance of misplaced or overwritten simulation data.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill gives conflicting instructions about where KMC directories must be created: one section says KMC must be created under the corresponding MSR directory, while another allows a direct KMC path under OUTPUT as a top-level task. In an agentic file-management skill, this ambiguity can cause the agent to create or read from the wrong location, breaking workflow assumptions and potentially bypassing safety checks tied to parent-directory validation.

Intent-Code Divergence

Low

Confidence: 91% confidence
Finding: The language-routing block references the wrong authoritative filenames, telling the agent to read SKILL_cn.md for English while the current file is itself SKILL_cn.md and the Chinese text later refers to SKILL.md as authoritative. This can cause the agent to load the wrong instruction source or recurse on the same file, leading to mis-execution of file operations and inconsistent safety behavior.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The routing instructions are internally inconsistent: they tell the agent to choose behavior based on user language, but the file names and authority rules conflict. In a skill that performs filesystem actions, such ambiguity can steer the agent into following the wrong document, which may omit or alter constraints around directory placement and file handling.

Static analysis

No suspicious patterns detected.