Security audit

skill-deep-audit

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate skill auditor, but its read-only claims are inaccurate because routine audits write into the audited skill directory.

Review before installing. Use it only where it is acceptable for the agent to read the target skill directory and create local artifacts such as AUDIT-*.md and possible Python cache files. Treat --fix as a separate mutation mode and require explicit, item-level confirmation before allowing it to edit skill files.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill markets itself as read-only by default, yet its normal audit flow requires writing an AUDIT file into the target skill directory. That contradiction can cause users to run it in environments where they expect zero writes, potentially violating repository cleanliness, CI assumptions, or safety boundaries.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: This is a stronger form of the same issue: the skill explicitly says not to modify audited files, then later mandates writing into the audited directory during every audit. Safety-critical contradictions in operational guidance are dangerous because downstream agents or users may trust the stricter statement and inadvertently permit file modifications in supposedly read-only contexts.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The invocation examples include generic phrases such as "is this skill ready to ship?" and "lint this skill" that can plausibly appear in ordinary conversation, increasing the chance that an agent auto-routes into this skill unintentionally. Because this skill performs broad file discovery and reads everything in scope, accidental activation can expand data exposure and trigger unnecessary audit workflows even if it remains read-only by design.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Instructing writes into the audited skill directory without prominent disclosure weakens informed consent and can lead to unexpected modifications of user content. In security-sensitive or automation contexts, even 'just a report file' can trigger policy violations, dirty working trees, or unintended side effects.

Static analysis

No suspicious patterns detected.