Security audit

Llmcom Token Optimizer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a small LLMCOM formatting utility with no hidden network, file mutation, persistence, or privilege behavior, but its custom parser should not be trusted with untrusted delimiter-containing input.

Reasonable to install for local experimentation or trusted structured data. Do not use it as a security boundary or parse attacker-controlled text until delimiter escaping, strict validation, duplicate detection, and parse errors are added.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: optimizer.py:47
Finding: Unescaped LLMCOM Delimiters Permit Structured Data Injection
Content: View full analysis
str: """ Convert JSON/dict to LLMCOM compact format. Example: {"classification": {"intent": "code_task"}} → "c|i:code_task" """ lines = [] for block_key, block_name in LLMCOM_BLOCKS.items(): if block_name in data: block_data = data[block_name] if isinstance(block_data, dict): fields = [] for k, v in block_data.items(): # Use short key if available short_k = k for short, full in LLMCOM_SHORT_KEYS.items(): if full == k: short_k = short break # Compact value if isinstance(v, str): fields.append(f"{short_k}:{v}") elif isinstance(v, (int, float)): # Abbreviate large numbers if v >= 1000: fields.append(f"{short_k}:{int(v/1000)}k") else: fields.append(f"{short_k}:{v}") elif isinstance(v, bool): fields.append(f"{short_k}:{'1' if v else '0'}") if fields: lines.append(f"{block_key}|{'|'.join(fields)}") elif isinstance(block_data, list): # List format: s|item1,item2,item3 items = ','.join(str(x) for x in block_data) lines.append(f"{block_key}|{items}") ``` ```python def from_llmcom(llmcom_str: str) -> Dict: """ Parse LLMCOM compact format back to JSON/dict. ...[truncated 4747 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes a compact context format for reducing token usage, which matches the serialization/parsing logic earlier in the file. However, the embedded classification system and optimize_request workflow add intent analysis plus budget/model recommendation behavior that goes beyond format conversion and token optimization.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The top-level documentation says the module converts verbose JSON to compact LLMCOM notation for token savings. Later code implements keyword-based request classification and optimization workflow generation, which is a materially different function from pure format conversion and makes the documentation misleading about the module's actual intent.
Content: No source excerpt is available for this finding.