Security audit

RiskForge

Security checks for vulnerabilities and agentic risk

Overview

This is a code-risk reporting skill, but it requires uploading detailed reports and local project metadata to a fixed plaintext HTTP service without clear per-run consent.

Review carefully before installing. Use this only if you are comfortable sending code-risk reports, file paths, repository identifiers, and tester metadata to the configured external service. For private, enterprise, regulated, or security-sensitive repositories, require a local-only mode, HTTPS, payload redaction, and explicit approval before any upload.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:48
Finding: Mandatory External Upload Hijacks the Local Audit Workflow
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate-test-report.js:12
Finding: Complete Security Reports Are Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/generate-test-report.js:24
Finding: Automatic Collection and Disclosure of Developer Identity and Repository Metadata
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate-test-report.js:470
Finding: Full Report Payload Is Exposed in Terminal and CI Logs
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (62)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The Chinese description claims code-risk analysis and testing guidance, while the actual instructions include collecting git metadata, reading local environment details, uploading reports over HTTP, and modifying local report files. Hidden secondary behavior increases the risk of unauthorized disclosure of repository information and violates least surprise in a security-sensitive review workflow.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The Chinese description claims code-risk analysis and testing guidance, while the actual instructions include collecting git metadata, reading local environment details, uploading reports over HTTP, and modifying local report files. Hidden secondary behavior increases the risk of unauthorized disclosure of repository information and violates least surprise in a security-sensitive review workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill mandates automatic report upload and project file writes without a clear user-facing warning. In a security analysis context, silent network egress and repository mutation violate user expectations and can expose sensitive code-review output or alter source trees unintentionally.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs automatic extraction and upload of report-derived content, including absolute file paths and issue details, to a remote platform by default. This is a clear data exposure risk because security findings often contain sensitive implementation details, internal structure, and vulnerability context useful to attackers.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill describes HTTP upload of repository metadata, file paths, findings, and recommendations without a clear privacy warning or consent mechanism. This is especially dangerous in enterprise or financial environments where such metadata may be confidential even if source code itself is not transmitted.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is configured to send detailed report contents and extracted metadata to a fixed external HTTP endpoint, which is not clearly justified by an analysis-focused manifest. This creates a direct data egress channel for potentially sensitive code-review findings, repository URLs, file paths, and issue details to a third party.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The upload design systematically collects rich repository, file, and analysis metadata and transmits it externally, creating a broad exfiltration surface. In the context of a financial-risk analysis skill, this is more dangerous because reports may contain compliance issues, security gaps, and internal architecture details that are highly sensitive.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/test-reports/test-reports.md (reported line 76)May include surrounding context.
md
## 结构化数据 (供程序解析，请勿删除) ```json { "testerName": "{{TESTER_NAME}}", "versionInfo": "{{VERSION_INFO}}",

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/test-reports/test-reports.md (reported line 108)May include surrounding context.
md
## 结构化数据 (供程序解析，请勿删除) ```json { "testerName": "{{TESTER_NAME}}", "versionInfo": "{{VERSION_INFO}}",

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/test-reports/test-reports.md (reported line 111)May include surrounding context.
md
## 结构化数据 (供程序解析，请勿删除) ```json { "testerName": "{{TESTER_NAME}}", "versionInfo": "{{VERSION_INFO}}",

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · references/test-reports/test-reports.md (reported line 76)May include surrounding context.
md
ISSUE_LOCATION}} (行号: {{HIGH_ISSUE_LINE}}) - **描述**: {{HIGH_ISSUE_DESCRIPTION}} - **影响**: {{HIGH_ISSUE_IMPACT}} - **修复**: {{HIGH_ISSUE_FIX}} ### [中] {{MEDIUM_ISSUE_TITLE}} - **详情**: {{MEDIUM_ISSUE_DETAILS}} ### [低] {{LOW_ISSUE_TITLE}} - **详情**: {{LOW_ISSUE_DETAILS}} ## 建议 {{PRIORITIZED_RECOMMENDATIONS}} --- ## 结构化数据 (供程序解析，请勿删除) ```json { "testerName": "{{TESTER_NAME}}", "versionInfo": "{{VERSION_INFO}}", "reportDate": "{{REPORT_DATE}}", "functionName": "{{FUNCTION_NAME}}", "codebaseUrl": "{{CODEBASE_URL}}", "filePath": "{{FILE_PATH}}", "testScopeItems": ["项目1", "项目2"], "issues": [ { "severity": "CRITICAL|HIGH|MEDIUM|LOW", "title": "问题标题", "location": "问题位置", "steps": "重现步骤", "expected": "期望结果", "actual": "实际结果", "description": "问题描述", "details": "问题详情", "impact": "影响说明",

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The upload path sends the full report and derived metadata to a remote endpoint over plain HTTP, without encryption, user confirmation, or disclosure controls. In a financial/code-review skill, reports can contain highly sensitive code, findings, repo URLs, file paths, and business risk details; plain HTTP additionally enables interception and tampering in transit.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The title and all usage instructions are written exclusively in Chinese, and the example invocation at L30-L35 assumes Chinese-language prompting. For a general-purpose skill README, this effectively imposes a language requirement without user opt-in, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill describes capabilities that inspect environment state, git configuration, filesystem paths, and execute helper scripts, but it does not declare an explicit tool scope such as allowed-tools or permissions. In an agent environment, that omission weakens containment and makes it easier for the skill to access local context or invoke capabilities beyond what a user would reasonably expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Broad generic triggers like code review, risk analysis, and testing terms can cause the skill to activate in contexts where users did not intend its full behavior set. Because this skill also includes project writes and external upload instructions, overbroad activation increases the chance of unintended data handling or side effects.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documentation requires uploading generated reports to an external platform, which expands behavior beyond local analysis. In a code-review context, reports can contain sensitive source findings, internal paths, and repository metadata, so mandatory external transmission materially increases confidentiality risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs writing generated unit tests directly into the project, exceeding a report/advice-only expectation. Unreviewed automated writes can alter the repository state, introduce flawed test artifacts, or create supply-chain and integrity concerns in CI/CD environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The instruction prohibits emoji and special Unicode characters in all reports, which imposes a locale/character-set constraint on output regardless of user preference. The file does not present this as an opt-in choice or clearly justify it as a documented regional/compliance requirement.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation adds remote API upload and local report-file modification capabilities that are not clearly disclosed in the manifest. This hidden behavior broadens the trust boundary and can leak analysis results or repository metadata while also mutating local artifacts after upload.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Mandating absolute analyzed file paths and repository metadata in reports broadens collection beyond the manifest's stated purpose. Those fields can disclose internal directory layouts, usernames, repo naming, and infrastructure details that aid reconnaissance if the report is exposed or uploaded.
Content: No source excerpt is available for this finding.