Security audit

123skill-display-name

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed self-improvement logger with opt-in reminder hooks; it has persistence risks to review, but no hidden data theft, destructive behavior, or purpose mismatch was found.

Install only if you want local, persistent learning logs. Prefer project-level hooks over global hooks, add a matcher if prompts may contain sensitive material, review the hook scripts before enabling them, and manually approve anything promoted into long-lived agent guidance files.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document states the scripts 'only output text' and 'don't modify files or run commands,' but the configuration explicitly invokes shell scripts via command hooks. That mismatch can mislead users into underestimating the trust boundary and execution risk, since any hooked script executes with the agent's permissions and could perform arbitrary actions if changed or replaced.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: An empty matcher causes the activator to run on every prompt, creating broad and continuous execution scope. In a self-improvement skill, that increases exposure to prompt-derived sensitive content, unnecessary script execution, and accidental persistence or logging across all interactions.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The user-level configuration installs the hook globally with an empty matcher, so it fires for all prompts in all sessions. That widens the blast radius from a single project to the entire user environment, making accidental collection, disclosure, or misuse of session content more likely if the script is modified or behaves unexpectedly.

Vague Triggers

Low

Confidence: 88% confidence
Finding: Although described as 'lower overhead,' the minimal setup still activates on every prompt because the matcher is empty. This is less severe than the global example, but it still encourages overly broad execution and may capture irrelevant or sensitive interactions without need.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The Codex CLI example mirrors the same empty-matcher pattern, causing the hook to run for every prompt without documented constraints. In CLI-based agent workflows, this can silently normalize broad interception of all user interactions and any related contextual data made available to hooks.

Static analysis

No suspicious patterns detected.