Security audit

ai-assistant-free

Security checks for vulnerabilities and agentic risk

Overview

This document-analysis skill is not clearly malicious, but it asks for broad command, file-write, callback, and external API capabilities that are not tightly scoped to basic document review.

Review this skill before installing. Use it only if you are comfortable granting command execution and file-write authority to a document-analysis workflow, and avoid providing confidential contracts, credentials, or callback URLs unless the publisher clarifies exactly what commands run, what files may be written, and what data can be sent externally.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as a basic long-document analysis tool, but the documentation broadens its scope to file writing, API integration, and command execution. That mismatch can cause agents or users to authorize capabilities far beyond what is necessary, increasing the chance of unsafe local actions or data exfiltration under the cover of a benign analysis skill.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The callback_url parameter introduces outbound network communication for a skill whose stated purpose is local document analysis. Even without explicit exploit code, this creates an unnecessary path for document contents, metadata, or results to be sent to external endpoints, which is risky in contract and memo review contexts.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Documenting system command execution for a document-analysis skill grants a powerful capability unrelated to the core task. In an agent environment, exec can be abused to access local files, invoke network tools, or alter the host system, making prompt injection or operator confusion materially more dangerous.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The documentation is internally inconsistent about whether extra API configuration is needed. This kind of contradiction weakens operator understanding and can lead users to provide credentials or enable networked behavior they did not expect, which is especially unsafe in a skill handling sensitive business documents.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill advertises file writing, external API use, and command execution without prominent warnings about data exposure, file modification, or system impact. Missing user-facing risk disclosure makes unsafe consent more likely and increases the chance that a benign-seeming analysis task triggers sensitive side effects.

Static analysis

No suspicious patterns detected.