Security audit

book-painter

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to book painter services, but its instructions are inconsistent and request broad local read/write/command authority without clear limits.

Review this skill carefully before installing. It may be intended for booking painter services, but its scope is unclear, it asks for broad local tool authority, and it does not clearly explain confirmation, provider endpoints, credential handling, or what information would be sent when placing an order.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest description claims the skill is for AI/LLM application use, while the body describes booking local painters through Lokuli. This misrepresentation can cause the agent to invoke the skill in unrelated contexts and expose users to unintended external actions, including bookings or data transfer to third-party services.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill documentation contradicts itself about whether this is a painter-booking tool or a generic AI/LLM capability. Contradictory purpose statements undermine safe routing and informed consent, making it easier for the skill to be activated under false assumptions and perform actions users did not expect.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill advertises file processing, file writing, and command execution even though those capabilities are not justified by a painter-booking workflow. Unnecessary high-privilege capabilities enlarge the attack surface and could be abused to modify local files or run commands if the agent grants tool access based on this documentation.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The security section claims only whitelist commands are executed, but the skill behavior does not define or enforce such a whitelist. This creates a false sense of safety and may lead operators to trust command execution paths that are effectively unconstrained.

Vague Triggers

High

Confidence: 96% confidence
Finding: The description uses broad, inconsistent invocation language covering AI models, dialogue, agent orchestration, and LLM apps despite the body describing painter booking. Overbroad activation criteria increase the chance the skill is selected in inappropriate contexts, which is especially dangerous because the skill appears capable of triggering external service actions.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The summary contains incomplete and vague trigger wording ('Use when user needs to find') that does not clearly define when the skill should run. Ambiguous triggers can cause accidental activation and reduce user awareness of what the skill will do.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The markdown describes scenarios involving finding and ordering local painter services but does not clearly warn that the skill may submit bookings or orders on the user's behalf. Hidden transactional behavior can lead to unauthorized purchases, data disclosure to vendors, and user harm through surprise side effects.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill describes write and command-execution capabilities without a clear warning that these actions can affect the local system. Users and orchestrators may not realize the skill can change files or execute commands, increasing the risk of unintended system modification.

Static analysis

No suspicious patterns detected.