Security audit

Litho Doc

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed repository documentation generator; it reads project code and writes documentation artifacts in ways that fit its stated purpose.

Before installing, make sure you are comfortable with the agent scanning the target repository and creating documentation plus temporary `.litho-agent/` files. Specify an output directory and whether temporary research files should be kept or deleted.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description is broad enough to auto-trigger on many generic documentation or codebase-analysis requests, which can cause the agent to invoke this skill in situations the user did not explicitly intend. In this skill’s context, that matters because the skill directs autonomous repository analysis and later file writes, so over-invocation increases the chance of unnecessary repo access and side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to persist intermediate artifacts into a .litho-agent/ directory and optionally delete them later, but it does not require informing the user or obtaining consent before modifying the repository. In a documentation skill, silent writes are risky because they can dirty the working tree, overwrite existing files, interfere with tooling, or remove data during cleanup.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file presents the entire skill guidance exclusively in Chinese, including headings, instructions, and expected report structure, with no indication that the user can choose another language or that Chinese is required for a justified region-specific purpose. That creates a natural-language locale policy concern because the skill effectively constrains interaction language without explicit opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file title and all instructional content are written in Chinese and present the required report formats in Chinese, implying a fixed language expectation for skill behavior. The document does not mention any option for users to choose another language or opt in to this locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The guideline states '使用用户指定的输出语言（默认中文)', which imposes a locale default in natural-language instructions. Under the policy, forcing or defaulting to a specific language without explicit user opt-in can be a locale-policy violation unless the constraint is clearly justified or the user is offered a choice first.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to persist intermediate analysis artifacts under .litho-agent/ and optionally delete them later, which grants local filesystem write/delete behavior beyond passive code analysis. In a documentation skill, this expands the attack surface: an adversarial repository or prompt could steer the agent into creating, overwriting, or removing files in the workspace, causing unintended state changes or data loss.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guide directs the agent to use write_to_file and replace_in_file to incrementally modify documentation files, which is a repository-modification capability rather than pure analysis/generation. Because the skill is intended for autonomous codebase analysis, this behavior could be abused to alter tracked files, inject misleading content, or overwrite existing documentation without clear user authorization.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.