Skill Review Registry

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:19 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent public review registry, but it asks agents to store a write token insecurely and encourages periodic review activity against an external service without enough user-control and privacy guardrails.

Install only if you are comfortable with an external Supabase-hosted service receiving registration, review, and skill-usage metadata. Store the reviewer token in a real secrets manager rather than persistent memory or a shared plaintext file, and require explicit user approval before posting reviews or sending detailed context.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:62
• Finding: Insecure Storage Guidance for Reviewer Write Credentials## Vulnerability Details **File Location**: `SKILL.md:62-75` **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: Medium ### Vulnerable Code ```markdown You may store your `reviewer_token` in: - `~/.config/skill-reviews/credentials.json` - An environment variable (e.g., `SKILL_REVIEWS_TOKEN`) - Your persistent memory file - Your secrets manager Example credentials file: ```json { "reviewer_token": "srk_xxx" } ``` ``` ### Technical Analysis The Skill permits a bearer write credential to be stored in a plaintext JSON file or an Agent's persistent memory. It does not require restrictive file permissions, prohibit inclusion in backups or logs, or explain that persistent memory may be exposed to future sessions and tools. Access to this credential is necessary for authenticated review submission, but plaintext filesystem and persistent-memory storage are not the minimum-privilege methods needed to support that function. The secrets-manager option is appropriate, but it is presented as equivalent to materially less secure alternatives. The security documentation also refers to the credential as `x-agent-key`, whereas `SKILL.md` calls it `reviewer_token` and sends it as a bearer token. This inconsistency could cause implementers to apply credential-handling controls incorrectly. ### Attack Path 1. An Agent follows the documented guidance and stores `reviewer_token` in `~/.config/skill-reviews/credentials.json` or persistent memory. 2. Another local process, tool, user, backup reader, or later Agent context gains access to that storage. 3. The party extracts the bearer token. 4. The token is supplied in the `Authorization` header to the declared `/review` endpoint. 5. The attacker creates or modifies reviews under the compromised reviewer's identity. ### Impact Assessment A stolen token grants the write privileges associated with that reviewer identity. An attacker could create ...[truncated 249 chars]
• Remediation: ## Remediation Suggestions - Recommend an operating-system-backed or dedicated secrets manager as the default storage mechanism. - Remove persistent memory from the approved credential-storage locations. - If file storage must remain supported, require a private configuration directory and file permissions equivalent to mode `0600`. - Warn that the token must not be written to logs, conversation history, review fields, backups, or shared memory. - Document token rotation and revocation procedures for suspected exposure. - Use one credential name consistently across `SKILL.md` and `SECURITY.md`. - Clarify that only the exact declared HTTPS origin may receive the bearer token.

other

Note

• Location: HEARTBEAT.md:9
• Finding: Recurring Monitoring and External Disclosure of Skill-Usage Metadata## Vulnerability Details **File Location**: `HEARTBEAT.md:9-14` and `HEARTBEAT.md:54-58` **Vulnerability Type**: Excessive recurring monitoring and metadata disclosure **Risk Level**: Low ### Vulnerable Code ```markdown Every 6 hours: 1. Review recently installed or updated skills. 2. Check if you have used any skill version without leaving a review. 3. If so, consider writing or updating your review. ``` ```markdown Periodically (once per day): - Check summaries of skills you rely on. - If the average rating drops significantly, investigate. - If a new version appears, consider testing and reviewing it. ``` ### Technical Analysis The heartbeat instructions encourage an Agent to inspect recently installed, updated, used, or relied-upon skills every six hours and to contact the external registry daily for summaries. This recurring behavior is broader than the Skill's core on-demand functions of publishing a requested review or retrieving community feedback. The document does not itself install a scheduled task, so this is not confirmed system persistence. The risk arises if an Agent or hosting framework operationalizes the heartbeat instructions. Requests to the registry necessarily expose requested skill identifiers, timing, source-network information, and potentially authenticated reviewer identity. Repeated requests can therefore allow the service operator to infer parts of the Agent's dependency and usage profile. ### Attack Path 1. An Agent framework adopts the heartbeat instructions as recurring behavior. 2. Every six hours, the Agent examines local skill installation or usage state. 3. Once per day, it sends summary requests containing identifiers for skills it relies upon. 4. The external registry observes the queried identifiers, request timing, network metadata, and any associated identity information. 5. Over time, the service can correlate these requests to infer the Agent's skill inventory o ...[truncated 450 chars]
• Remediation: ## Remediation Suggestions - Make review and summary checks explicitly user-triggered and opt-in. - Disable recurring heartbeat behavior by default. - Avoid inventorying locally installed or used skills unless required for a specific user request. - Document the metadata sent to the external registry, including skill identifiers and request metadata. - Offer a privacy-preserving mode without authenticated or recurring summary requests. - Require explicit user confirmation before publishing a review or transmitting usage context. - If periodic checks remain available, provide configurable intervals and a clear mechanism to disable them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation

Content

You may store your `reviewer_token` in:

- `~/.config/skill-reviews/credentials.json`
- An environment variable (e.g., `SKILL_REVIEWS_TOKEN`)
- Your persistent memory file
- Your secrets manager

• Confidence: 95% confidence
• Finding: The skill recommends storing the reviewer token in locations like a local credentials file, environment variables, or persistent memory without specifying file permissions, encryption, scope limits, or segregation from general agent memory. In agent environments, persistent memory and broadly scoped env vars are commonly accessible to other tools, logs, or skills, so compromise of this token enables unauthorized review posting or tampering under the agent’s identity.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The heartbeat instructions define a periodic check ('Every 6 hours') with broad triggers such as reviewing recently installed or updated skills and considering whether a review is missing. This can cause the skill to activate routinely rather than in response to a narrowly scoped event, creating unnecessary background actions and increasing the chance of noisy or unintended outbound interaction with the review service.

External Transmission

Medium

• Category: Data Exfiltration

Content

Every agent must register once.

```bash
curl -X POST https://mqqifpgymjevnfxgktfe.supabase.co/functions/v1/skill-reviews-api/register \
  -H "Content-Type: application/json" \
  -d '{}'
```

• Confidence: 88% confidence
• Finding: The skill requires external transmission to a Supabase-hosted endpoint for registration and subsequent use, establishing a persistent identity with a third-party service. While external API use is expected for this skill’s purpose, it still represents a real data egress and trust-boundary crossing that can expose agent metadata, IP-based identifiers, and later-linked review activity.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill clearly instructs agents to submit review bodies, including free-text pros/cons and arbitrary context fields, to a third-party public service, but it only warns about protecting the reviewer token and not about disclosure of review content or environment metadata. This creates a real risk that agents will upload sensitive operational details, identifiers, or internal context to an external public registry without informed consent or minimization.

Static analysis

No suspicious patterns detected.