autoskill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:01 AM UTC
• Version: 1.1.1

Overview

This skill is a transparent skill router that installs a slash command and requires user confirmation before invoking any other skills.

Before installing, be aware that this is a meta-skill: once you approve its plan, it can invoke other skills, and those downstream skills may have their own file, network, or external-service effects. Review the displayed execution plan carefully, decline high-risk skills you do not trust, and use cancel when the recommended queue is broader than you intended.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The main mismatch is in the installed slash command metadata and body. The declared description says the skill only analyzes and recommends skills, and that no skill is ever invoked without explicit approval. But the generated command says 'Auto-detect and apply all relevant skills for the current problem' and instructs Claude to 'Read and follow ~/.claude/skills/autoskill/SKILL.md from top to bottom,' which implies operational execution rather than passive recommendation. The filesystem writes performed by install.sh are normal supporting installation behavior and not themselves a mismatch. However, the command’s stated behavior materially exceeds the declared safe routing/recommendation role.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 5)May include surrounding context.

sh

# Install autoskill into ~/.claude/skills/ and ~/.claude/commands/
#
# To uninstall:
#   rm -rf ~/.claude/skills/autoskill
#   rm -f  ~/.claude/commands/autoskill.md
#
set -e

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 5)May include surrounding context.

sh

# Install autoskill into ~/.claude/skills/ and ~/.claude/commands/
#
# To uninstall:
#   rm -rf ~/.claude/skills/autoskill
#   rm -f  ~/.claude/commands/autoskill.md
#
set -e

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 6)May include surrounding context.

sh

#
# To uninstall:
#   rm -rf ~/.claude/skills/autoskill
#   rm -f  ~/.claude/commands/autoskill.md
#
set -e

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The installed slash-command says to 'Read and follow' the skill top-to-bottom and to auto-apply relevant skills, which conflicts with the metadata claim that autoskill only recommends skills and never invokes them without explicit approval. This mismatch can mislead the agent or user into granting broader execution semantics than advertised, creating a prompt-driven escalation path if the referenced SKILL.md contains unsafe routing or invocation instructions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 17)May include surrounding context.

sh

echo "Installing autoskill..."

# Install skill
mkdir -p "$SKILL_DIR"
cp "$SCRIPT_DIR/SKILL.md" "$SKILL_DIR/SKILL.md"
echo "  ✓ Skill installed → $SKILL_DIR/SKILL.md"

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install.sh (reported line 29)May include surrounding context.

sh

argument-hint: "[problem description or blank to infer from conversation]"
---

Read and follow `~/.claude/skills/autoskill/SKILL.md` from top to bottom.
Pass `$ARGUMENTS` as the problem statement to Phase 1.
EOF
echo "  ✓ Command installed → $CMD_DIR/autoskill.md"

Static analysis

No suspicious patterns detected.