Security audit

agent-chat

Security checks for vulnerabilities and agentic risk

Overview

This skill presents as a temporary agent chat room, but it requests and describes broad file, API, and command-execution abilities that are not clearly scoped to chat.

Review this carefully before installing. Only use it if you are comfortable giving a chat-themed skill broad read/write and command-execution authority, and avoid sharing sensitive chat content until the publisher narrows the tools and clearly documents storage, retention, and network behavior.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill is advertised as a temporary agent chat-room, but the documentation expands it into broad file processing, API access, and command execution capabilities. This scope mismatch is dangerous because an agent or reviewer may grant the skill trust appropriate for messaging while it implicitly authorizes far more powerful actions, increasing the chance of unintended data access or system-side effects.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Declaring system command execution for a chat-room skill violates least privilege and materially increases risk. If invoked by an agent under the assumption that this is only a messaging utility, the exec capability could be used to run local commands, access sensitive environment data, or modify the host system.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Generic file read/write/parse capabilities exceed what a temporary chat-room service would normally require and create unnecessary access to local data. In an agent environment, this can lead to accidental exposure, modification, or exfiltration of unrelated files if the skill is over-trusted or misused.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: Presenting broad external API integration as a general capability extends the skill beyond its stated chat-room role and introduces additional network and data-sharing risk. Agents may send prompts, messages, or sensitive context to third-party services without operators understanding that this skill performs broader external communication.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The parameters and outputs describe a generic pipeline executor rather than a chat-room interface, creating a misleading contract between the skill description and actual behavior. This ambiguity can cause agents or users to invoke the skill with inappropriate trust, enabling unintended execution flows, retries, step skipping, and opaque processing outside the expected chat context.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The invocation description is overly broad and ambiguous, encouraging use across general AI orchestration and LLM applications instead of a narrowly defined chat purpose. Overly broad positioning increases the likelihood that agents route sensitive or high-impact tasks through a skill whose real boundaries and side effects are unclear.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The markdown does not clearly warn about chat-history retention, external communication, or network side effects despite describing password-protected real-time chat with SSE and history retrieval. This omission is risky because users may place sensitive content into the system without understanding persistence, forwarding, or exposure implications.

Static analysis

No suspicious patterns detected.