Security audit

account-ban-emergency

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent emergency account-recovery purpose, but it can make persistent operational account changes and writes incident data into another skill's learning store without enough scoping or user control.

Review before installing. This skill is designed for urgent account-ban response and may be appropriate for controlled operations, but install it only where account switching, service pausing, platform notifications, appeal orchestration, and persistent incident logging are acceptable. Require operator approval for switch/publish/appeal steps and either disclose or disable the cross-skill self-growth logging if account identifiers or ban reasons should stay local to this skill.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares powerful capabilities via tools: [read, exec] and explicitly instructs shell execution of Python scripts plus file writes to data/ban_events, tenant_cookie_map.json, and related state files, yet there is no explicit permissions model or narrowing of allowed resources. In an emergency workflow that can pause services, switch accounts, and mutate operational mappings, this creates a high-risk gap where the skill can perform broad state-changing actions without clear authorization boundaries or user-facing consent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior materially differs from the observed behavior: it appears to modify account/cookie mapping files, write operational and learning-history records, invoke a self-growth subprocess, and only emit orchestration instructions for some critical steps rather than actually performing them. This mismatch is dangerous because operators may trust the skill to execute a contained 7-step emergency process while it performs additional side effects or leaves key recovery/appeal steps incomplete, causing hidden state changes, data leakage, or operational failure during an incident.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Post-incident analysis writes account-ban data into a separate cross-skill 'self-growth' store and invokes an unrelated helper skill, creating an unnecessary data-sharing and trust-boundary expansion. In this context, account identifiers and ban reasons may be propagated beyond the emergency workflow, increasing privacy exposure and enabling unintended influence from or on another skill's state.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The trigger conditions include broad manual activation without clear authorization, validation, or scoping constraints. In a skill that can suspend automation, switch backup accounts, and alter account mappings, overly permissive triggering increases the chance of accidental or unauthorized invocation that disrupts business operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill description does not clearly warn that running it will pause tasks, switch accounts, and write recovery/state artifacts to disk. This omission is dangerous because users may invoke an emergency workflow without understanding that it will make persistent operational changes, potentially causing service interruption, state corruption, or hard-to-reverse account remapping.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The workflow sends external notifications and initiates appeal-channel interactions, but the description lacks a clear privacy and data-transmission warning about what account, incident, or customer-related information may leave the system. During account-ban handling, these messages can contain sensitive operational details, making undisclosed external transmission a meaningful confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.