Security audit

Skill Release Audit

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed static audit tool with an opt-in dependency installer that users should treat carefully, but I found no hidden exfiltration, persistence, destructive behavior, or deception.

Install is reasonable for normal report-only use. Avoid --auto-install unless you trust the skill being audited and are comfortable letting pip fetch and execute packages inferred from that skill's imports; prefer reviewing the reported install commands and installing dependencies manually in an isolated environment.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill describes capabilities that include reading files, inspecting environment variables, invoking shell commands, and optionally performing package installation, yet it does not declare permissions. This creates a transparency and governance gap: users or hosting platforms may grant broader trust than intended, and the optional auto-install path adds real environment mutation risk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill is presented as a pure reporter that never edits files or publishes, but the documented --auto-install mode can change the user's environment by invoking pip, and the env-var inspection behavior is more security-relevant than the summary suggests. This mismatch can mislead users and automated reviewers into running a skill with a higher trust level than warranted.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill is described as a pure reporter that never edits files, but this code can install Python packages when auto_install is enabled. Installing packages changes the execution environment and may execute arbitrary code from package build/install hooks, creating a supply-chain risk and violating user expectations about non-mutating audit behavior.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The module-level contract says confirmation is baked into the main flow, but the installation function itself performs package installation solely based on a boolean flag. In agent ecosystems, such mismatches are dangerous because wrappers or callers may set the flag without presenting a meaningful user confirmation, leading to unexpected environment mutation.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill metadata and module docstring describe this tool as a pure reporter that never modifies the environment, but the entrypoint explicitly exposes an --auto-install path that can invoke pip installation. In a security-audit or release-gate context, unexpected environment mutation is dangerous because it violates operator expectations, can introduce unreviewed code from package indexes, and changes the system state during what should be a read-only assessment.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The CLI parser adds an --auto-install option for a tool whose stated purpose is static pre-publish auditing. Even though it is opt-in, bundling dependency installation into an auditor encourages users to run networked, code-fetching package installs in the same workflow as trust evaluation, which increases supply-chain and environment-integrity risk.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The top-level usage text says the default behavior is report-only and the skill description says it never edits files or publishes, yet the code supports side effects through auto-install. This documentation/behavior mismatch is security-relevant because users may rely on the published safety claims and execute the tool in sensitive environments where any package installation is unacceptable.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.