Security audit

can-free

Security checks for vulnerabilities and agentic risk

Overview

The skill mainly describes local content hashing and logging, but it also requests broad read/write/exec authority and contains inconsistent callback, API, network, and command-execution claims that users should review before installing.

Install only if you are comfortable granting a local logging skill read/write access and potential exec authority. Treat callback_url, API integration, and command-execution references as unresolved scope issues; avoid using this skill with sensitive content unless those behaviors are clarified or removed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is presented as a local content-addressing/logging tool, yet its input spec includes a callback URL and the document discusses API-style behavior. This mismatch can mislead users into providing data under the assumption it stays local, creating an unannounced path for off-system data transmission.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The free edition claims that endpoint verification and network-backed features are paid-only, but later advertises API integration and external service usage. Such contradictory capability claims obscure the real trust boundary and may enable unexpected external communications or feature abuse in a skill that users believe is offline/local.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The documentation advertises command execution even though the stated purpose is content hashing and append-only logging. Exposing exec in a skill without a narrow, justified operational need increases the attack surface substantially, especially if future implementations pass user-controlled input into shell commands.

Intent-Code Divergence

High

Confidence: 93% confidence
Finding: The document states the free edition does not provide endpoint verification, but later troubleshooting assumes authenticated API use, rate limiting, and network timeouts. This inconsistency suggests hidden or undeclared network behavior, which is dangerous because users cannot accurately assess data exposure, credential handling, or external dependency risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The presence of a callback URL and API-oriented workflow without an explicit warning that input or results may be transmitted off-system creates a privacy and confidentiality risk. Users may provide sensitive content expecting local hashing/logging only, unaware that data could be sent to remote endpoints.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The skill describes writing append-only logs locally but does not clearly warn users that invocation may persist data to local files. For a content-processing skill, silent persistence can expose sensitive inputs to later disclosure through filesystem access, backups, or shared environments.

Static analysis

No suspicious patterns detected.