Security audit

skill-medic

Security checks across malware telemetry and agentic risk

Overview

This looks like a legitimate skill-audit tool, but it needs Review because it scans global and hidden skill folders by default, persists audit data locally, and can trigger online rubric updates without a clear consent step.

Install only if you are comfortable with a skill that audits other installed skills, including global and hidden agent skill folders. Prefer running it with an explicit workspace-only scope when you do not want home-directory skill metadata scanned, review .medic outputs before committing or sharing the project, and decline or disable online rubric updates unless you want network access during the audit.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes capabilities to read files, write reports to disk, and use environment/tooling, but does not declare permissions in a transparent way. This creates a trust and containment gap: users and the platform may not realize the operational reach of the skill before it inventories local skills, writes artifacts, or consults environment-dependent tooling.

Intent-Code Divergence

Low

Confidence: 72% confidence
Finding: The FAQ introduces network updates for scoring standards despite the skill being framed as a local inventory/audit tool with CLI-centered constraints. Undisclosed or weakly disclosed network behavior expands the attack surface, can leak metadata about local environments, and changes the trust model for a tool that users may expect to remain offline.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The reporter skill is supposed to generate and present an audit report, but it also mutates session state and conditionally triggers cleanup operations. This expands the skill from read/report behavior into operational side effects, which can delete artifacts or alter workflow state without the user's informed consent.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Session-state mutation and execution of cleanup commands are not necessary for a user-facing skill whose declared purpose is auditing installed skills. These capabilities create unnecessary authority, increasing the blast radius if the skill is invoked unexpectedly or chained with other components.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The tool enumerates global per-user skill directories under the home directory in addition to the provided project root. That expands its visibility beyond the requested workspace and can disclose unrelated installed skills, metadata, and file paths from the user's wider environment, which is a confidentiality boundary issue even if it is read-only.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The skill instructs writing a comprehensive inventory file to `.medic/_medic_inventory.json` containing workspace and global skill metadata, paths, structure flags, and potentially sensitive dependency identifiers, but does not require user notice, consent, minimization, or retention controls. In a security-review context this increases privacy and information-exposure risk, because persisted inventories can later be read by other tools, committed to source control, or leaked from the workspace.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The skill requires user-facing output to be in Chinese only, without indicating any language negotiation or opt-in. This can cause accessibility and usability failures for users who do not read Chinese, and may lead the agent to ignore the user's preferred language or organizational policy. In this skill's context, the issue is less about direct security compromise and more about unsafe operational behavior through reduced transparency and user comprehension.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill requires automatic local file writes without any user confirmation or warning, which creates an unintended side effect on the user’s filesystem. Even though the target path is local and appears limited to audit artifacts, silent persistence can leak sensitive inventory details, create clutter, or violate user expectations and policy boundaries around write actions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill defines automatic network access on first run, when the rubric is older than 30 days, or when the user explicitly requests it. The first-run and age-based triggers can cause external requests without an explicit per-run user warning or consent, which creates privacy and transparency risks because skill metadata, prompts, or derived context may be sent to third-party services unexpectedly.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The skill states that it writes baton and intermediate/report files to .medic/, but does not present this persistence as a prominent user warning or consent point. Silent local artifact creation can expose inventory details, create privacy surprises on shared machines, and leave stale analysis data available to other processes or users.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: Mentioning联网更新 without a clear, explicit warning deprives users of informed consent about external communication. In a tool that scans installed skills, even limited network activity can disclose usage patterns, versioning, or derived metadata, and it materially increases privacy and supply-chain risk.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The controller explicitly instructs the agent to create, reset, and overwrite `.medic/_medic_baton.json` and related state on startup or resume, but it does not require user awareness or confirmation before modifying workspace files. In an agent skill, silent stateful writes can surprise users, clobber prior session data, or normalize broader unattended file modification patterns, even if the target path is relatively constrained.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The skill explicitly instructs writing scan results to `.medic/_medic_inventory.json` in the workspace, but provides no requirement to obtain user consent or warn that the scan modifies files. Even though the write is low-risk and appears intended for normal operation, silent filesystem modification can surprise users, interfere with repos, and create audit or privacy issues in sensitive workspaces.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill requires writing a report to disk automatically, but the user-facing description does not clearly warn that files will be created. Silent persistence can surprise users, expose sensitive inventory results on disk, and violate expectations for a reporting-only interaction.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill describes cleanup that removes intermediate artifacts, yet there is no clear user warning that files may be deleted. Even if limited to intermediate outputs, undeclared deletion behavior is risky because it can destroy evidence, interrupt troubleshooting, or remove data the user expected to keep.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The FAQ states that the skill may trigger a network-based standards update on first use, when standards are older than 30 days, or when the user requests it, but it does not clearly warn the user that external connectivity will occur or what metadata/content may be transmitted. In a skill that audits other installed skills, even limited remote lookups can create privacy and transparency risks because users may not expect any outbound access during an inventory or review operation.

Agent Config Directory Access

High

Category: Agent Snooping
Content: # 文件系统扫描仅用于补充路径/静态指标，禁止因为"目录探测不到"就判定没有 Skill SKILLS_DIR_CANDIDATES = [ os.path.join(".trae", "skills"), # Trae IDE os.path.join(".claude", "skills"), # Claude Code os.path.join(".cursor", "skills"), # Cursor os.path.join(".codex", "skills"), # OpenAI Codex "skills", # 通用约定
Confidence: 89% confidence
Finding: os.path.join(".claude

Agent Config Directory Access

High

Category: Agent Snooping
Content: os.path.join(".trae", "skills"), # Trae IDE os.path.join(".claude", "skills"), # Claude Code os.path.join(".cursor", "skills"), # Cursor os.path.join(".codex", "skills"), # OpenAI Codex "skills", # 通用约定 ] GLOBAL_SKILLS_DIRS = [ # 全局 Skill 候选目录（§9.1，探测不到不阻断）
Confidence: 89% confidence
Finding: os.path.join(".codex

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.