account-ban-emergency

• Outcome: Review
• Latest audit: Aug 15, 2026 · 4:29 AM UTC
• Version: 1.0.2

Overview

This skill has a coherent emergency account-recovery purpose, but it can make persistent operational account changes and writes incident data into another skill's learning store without enough scoping or user control.

Review before installing. This skill is designed for urgent account-ban response and may be appropriate for controlled operations, but install it only where account switching, service pausing, platform notifications, appeal orchestration, and persistent incident logging are acceptable. Require operator approval for switch/publish/appeal steps and either disclose or disable the cross-skill self-growth logging if account identifiers or ban reasons should stay local to this skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares powerful capabilities via `tools: [read, exec]` and explicitly instructs shell execution of Python scripts plus file writes to `data/ban_events`, `tenant_cookie_map.json`, and related state files, yet there is no explicit permissions model or narrowing of allowed resources. In an emergency workflow that can pause services, switch accounts, and mutate operational mappings, this creates a high-risk gap where the skill can perform broad state-changing actions without clear authorization boundaries or user-facing consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior materially differs from the observed behavior: it appears to modify account/cookie mapping files, write operational and learning-history records, invoke a self-growth subprocess, and only emit orchestration instructions for some critical steps rather than actually performing them. This mismatch is dangerous because operators may trust the skill to execute a contained 7-step emergency process while it performs additional side effects or leaves key recovery/appeal steps incomplete, causing hidden state changes, data leakage, or operational failure during an incident.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Post-incident analysis writes account-ban data into a separate cross-skill 'self-growth' store and invokes an unrelated helper skill, creating an unnecessary data-sharing and trust-boundary expansion. In this context, account identifiers and ban reasons may be propagated beyond the emergency workflow, increasing privacy exposure and enabling unintended influence from or on another skill's state.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger conditions include broad manual activation without clear authorization, validation, or scoping constraints. In a skill that can suspend automation, switch backup accounts, and alter account mappings, overly permissive triggering increases the chance of accidental or unauthorized invocation that disrupts business operations.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill description does not clearly warn that running it will pause tasks, switch accounts, and write recovery/state artifacts to disk. This omission is dangerous because users may invoke an emergency workflow without understanding that it will make persistent operational changes, potentially causing service interruption, state corruption, or hard-to-reverse account remapping.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The workflow sends external notifications and initiates appeal-channel interactions, but the description lacks a clear privacy and data-transmission warning about what account, incident, or customer-related information may leave the system. During account-ban handling, these messages can contain sensitive operational details, making undisclosed external transmission a meaningful confidentiality and compliance risk.

Static analysis

No suspicious patterns detected.