Security audit

Cowhorse Skill

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed workflow-and-skill builder that asks structured questions and can create skill files, with no evidence of hidden data theft or destructive behavior.

Install this only if you want an assistant that actively questions you and may help create, test, package, and remember new skills. Before approving any build step, review the target paths, generated scripts, package output, and any MEMORY.md or memory-log updates.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The guide expands the skill from requirements elicitation into creating skill directories, writing SKILL.md, adding scripts/assets, testing, packaging, and updating memory files. That materially exceeds the declared purpose and can normalize broad file creation/modification behavior, increasing the chance the agent performs unintended local changes when a user only asked for workflow clarification.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The example workflow includes updating local application code, README/build documents, and other unrelated files under local paths. In context, this teaches the agent to move from analysis into modifying executables and user files, which can lead to unauthorized changes, scope creep, and damage to local environments if followed automatically.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: The iteration pattern instructs persistent logging of user feedback to dated memory files without establishing necessity, retention limits, or consent. Even if the stored data seems operational, persistent memory can accumulate sensitive business details, file paths, and user preferences beyond the skill's stated purpose.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger phrases are generic, high-frequency requests such as '建一个 skill' and '梳理流程', which can easily match normal conversation and cause the skill to activate when the user did not explicitly intend to invoke it. In this skill, unintended activation is more concerning because it drives the agent into a structured questioning and workflow-construction process, which can derail user intent, collect unnecessary task details, and cause downstream file or skill generation actions.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrases are broad everyday requests such as '帮我做一个workflow' and '帮我做一个工具', which can cause the skill to activate in contexts where the user did not explicitly ask for skill creation. Unintended activation is risky here because this skill proceeds toward file creation, packaging, and workflow scaffolding, increasing the chance of unexpected side effects.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to create directories, write SKILL.md, add scripts/assets, package the skill, and update MEMORY.md, but it does not require explicit user warning or confirmation before making filesystem changes. This can lead to surprising writes, overwrites, or persistent workspace modifications, especially if the skill is triggered unintentionally or the target paths are ambiguous.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.