Security audit

auto-workflow

Security checks across malware telemetry and agentic risk

Overview

This skill should be reviewed carefully because it tells an agent to create and run automations without clear user approval or safety limits.

Install only if you are comfortable with an agent proposing automation from repeated work, and require explicit approval before any generated script runs, sends messages, changes files, creates scheduled jobs, handles credentials, or touches backups or business data. Do not rely on the artifact's claimed encryption, audit, access-control, or API-key protections unless your host platform separately provides them.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The documentation states that no extra API key is needed except for explicitly marked external APIs, yet the skill also depends on LLM/API and HTTP behavior. This mismatch can mislead users about network use, credential requirements, and data exposure, causing unsafe deployment assumptions rather than directly enabling code execution.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The file presents a runnable Python example importing a library that is not provided, while the skill is described as Markdown instruction-driven. Users may try to install similarly named packages or execute unverified third-party code to make the example work, creating a supply-chain and unsafe execution risk.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The Markdown-only skill claims security features such as encryption, access control, audit logging, and API-key protection that are not actually implemented here. These unsupported assurances can cause users to trust the skill with sensitive data or operational access under false security assumptions, significantly increasing exposure.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger keywords are extremely broad and overlap with ordinary conversation, increasing the chance of accidental activation. In a skill that can generate and execute scripts, overbroad triggering raises the likelihood of unintended automation actions being proposed or initiated in the wrong context.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The repeated trigger section remains ambiguous and does not define when the skill should or should not activate. Because the skill is oriented toward building and executing automation, ambiguous activation increases the risk of unintended script generation, user confusion, and unsafe context switching.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill advertises generating automation workflows and execution scripts without a prominent warning that scripts may be unsafe, environment-specific, or require review before execution. In the presence of the declared exec capability, this omission can lead users or agents to run generated commands without adequate scrutiny.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The instruction to 'directly do it' and not wait for user request encourages autonomous action without explicit authorization. In a skill with exec access and a stated goal of turning repeated behavior into runnable automation, this materially increases the risk of unauthorized command execution, data modification, or persistence of unintended workflows.

Ssd 4

Medium

Confidence: 96% confidence
Finding: The progression from observing repeated behavior to acting without explicit request creates a permission-escalation pattern where the agent may infer consent from context rather than receiving it. This is especially risky because the skill includes exec capability and is designed to convert observations into executable automation steps.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.