Licia

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 1.0.0

Overview

This markdown-only skill is not malicious, but it should be reviewed because broad refactoring instructions expose risky licia APIs like eval, filesystem deletion, HTTP, and process control without clear guardrails.

Install only if you want the agent to recommend licia broadly, and review generated changes carefully. Treat suggestions involving evalJs, fs write/delete, rmdir, kill, open, ajax/fetch, cookies/storage, or raw HTML insertion as requiring explicit user intent and extra review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: A direct JavaScript execution helper enables execution of arbitrary code strings, which is one of the highest-risk capabilities an agent can expose. Combined with the skill's excessive scope, this could be used to run attacker-controlled code, bypass intended task boundaries, or manipulate the surrounding runtime and data.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Broad filesystem read/write/delete capabilities are not justified for a utility-library refactoring skill and materially expand blast radius. An agent with these capabilities could overwrite source files, delete data, persist unwanted artifacts, or access sensitive local information.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Arbitrary HTTP request capabilities are unrelated to local code simplification and can be abused for exfiltration, SSRF-like access to internal services, or fetching untrusted payloads. In an agent environment, this meaningfully increases both outbound and inbound attack surface.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Presenting a direct JavaScript execution helper without a prominent warning understates an extremely dangerous capability. Even if intended as a utility, users or agents may treat it as normal infrastructure and execute untrusted code strings, leading to arbitrary code execution in the current context.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Exposing a process-killing primitive in a utility/refactoring skill grants destructive host control unrelated to the declared task. If an agent can invoke or recommend this capability, it could terminate security tools, services, or user workloads, causing denial of service or facilitating defense evasion.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Documenting shell/open-child-process behavior gives the skill a path to launch external resources or programs outside its stated purpose. In an agent setting, this can be abused for arbitrary command execution, untrusted URL launching, or chaining into additional system compromise.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: Recursive directory removal is a highly destructive operation, and documenting it without safeguards or warnings increases the risk of catastrophic data loss. In the context of a code utility skill, this is especially dangerous because the capability is unjustified and easy to misuse.

Ae1

High

• Category: analysis-evasion

Content

2. Look up the specific utility in `DOC.md` for API details and examples

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

2. Look up the specific utility in `DOC.md` for API details and examples

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The documented capability surface is far broader than the skill's stated purpose of code simplification with a utility library. Including process, filesystem, networking, code execution, and OS-interaction features in a refactoring-focused skill creates dangerous capability mismatch and increases the chance an agent can be induced to perform unrelated high-risk actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The DOM insertion APIs accept raw HTML strings and the documentation presents them without any warning about injection risk. In real usage, developers may pass untrusted input into append/prepend/before/after, leading to XSS or DOM clobbering in browser contexts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The HTML setter exposes a raw innerHTML-style sink but the documentation omits any warning about untrusted content. This can normalize unsafe usage patterns and lead downstream users to introduce client-side XSS when setting HTML from external or user-controlled data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Process-killing functionality is destructive, and omitting warnings can encourage accidental or unsafe operational use. In an agent-assisted environment, even documentation alone can normalize use of a host-destructive primitive unrelated to the skill's purpose.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill advertises activation on very broad conditions like writing utility functions, data manipulation, string processing, DOM operations, or any code that could be replaced by a utility. This can cause the skill to trigger in many ordinary development contexts, increasing the chance of unnecessary influence over agent behavior and unintended dependency recommendations across unrelated tasks.

Static analysis

No suspicious patterns detected.