Security audit

Audit Toolkit Free

Security checks for vulnerabilities and agentic risk

Overview

The skill is a Markdown audit toolkit, but it asks agents to handle sensitive audit evidence, write local logs, and use command execution without clear limits or storage controls.

Review this skill before installing if you may use it with source code, contracts, financial records, or private AI prompts. Treat its logs as ordinary local files, not tamper-proof records, and only allow command execution or local logging after you know what data will be written and where.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The declared coverage keywords are extremely broad, including common terms such as 'Use', 'when', and general audit/security language, making scope ambiguous and increasing the probability of unintended routing. This is especially risky here because the skill presents itself as suitable for security detection and can use exec, so overbroad matching can expand operational reach far beyond a narrowly intended audit assistant.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill markets '加密防护' as a supported use case in the manifest description, while later documentation states the free edition does not support cryptographic certified signing or anti-tamper protection. This mismatch can mislead users into relying on the skill for security properties it does not actually provide, creating false assurance around sensitive audit or protection workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The invocation language is broad enough to match many ordinary security or compliance-related requests, which can cause the skill to activate in situations beyond the user's clear intent. Because the skill also has exec capability, ambiguous triggering increases the chance of unnecessary command execution or handling of sensitive data under loosely defined conditions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The examples use very generic user phrases such as asking to audit code or verify funds, which overlap with normal conversation and make accidental activation plausible. In a skill that can read, write, and execute commands, accidental activation is a safety issue because the agent may begin collecting evidence, storing data, or invoking tools without sufficiently explicit consent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document repeatedly promises '不可变日志' and trustworthy evidence retention, but the declared capabilities are only ordinary read/write/exec with local storage and no technical immutability control. In an audit context, this is dangerous because users may treat mutable local files as tamper-evident records, undermining integrity, non-repudiation, and the credibility of audit conclusions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill states that evidence logs are stored locally and that some functions require exec, but it does not clearly disclose what data may be written, where it is stored, what commands may run, or the security/privacy consequences. In audit workflows, inputs may contain source code, financial records, contracts, or AI outputs, so weak disclosure can lead to unintended exposure of sensitive data or unsafe command execution expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The license section states '完全中文化表达，适配中文审计场景', indicating the skill is intentionally fully localized to Chinese. The document does not offer language selection or explain that the skill is restricted to a specific region or compliance context, which creates a locale policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.