Security checks for vulnerabilities and agentic risk
Overview
The skill mostly provides consumer cloud-storage advice, but it asks for command execution, API-key setup, callbacks, and orchestration-style features that are not clearly needed for that advisory purpose.
Review this skill carefully before installing. It appears to be an advisory cloud-storage helper, but it requests more authority than it explains. Prefer installing only if your host can deny exec, limit file reads, and avoid providing API keys unless a specific, documented use is added. Treat cleanup and sharing advice cautiously because deleting cloud trash, changing backups, or creating share links can affect recoverability and privacy.
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T05 · Unauthorized Access and Privilege Escalation
Warning
Location
SKILL.md:16
Finding
Unnecessary Local File and Command Execution Permissions
Content
View full analysis
Vulnerability Details
File Location: SKILL.md, lines 16–18 Vulnerability Type: Excessive tool permissions violating least privilege Risk Level: Medium
yaml
tools:
- read
- exec
Technical Analysis
The Skill requests both local file-reading and command-execution capabilities even though its documented purpose is to provide consumer cloud-storage recommendations and procedural guidance. The Skill does not document any operation that requires inspecting local files or executing operating-system commands. It also states that it does not provide concrete cloud-service API operations.
This violates the principle of least privilege. If the hosting Agent grants the declared tools, content processed during a Skill session could potentially influence the Agent to invoke read or exec for purposes unrelated to the Skill's legitimate function. The declaration alone does not prove automatic command execution, but it unnecessarily exposes powerful capabilities that could amplify malicious or untrusted task content.
Attack Path
A user or another untrusted input source supplies crafted task content while the Skill is active.
The content attempts to persuade the Agent that reading a local file or running a system command is necessary to complete a cloud-storage guidance task.
Because the Skill declares read and exec, a permissive host may make those capabilities available to the Agent.
The Agent invokes a declared tool without sufficient confirmation or path and command restrictions.
The attacker-controlled request may cause unauthorized local file disclosure or execution of commands with the privileges of the Agent process.
Exploitation depends on the hosting Agent granting these tools and failing to enforce independent authorization, sandboxing, or user-confirmation controls.
Impact Assessment
If successfully exploited, read could expose files accessible to the Agent
...[truncated 541 chars]
Remediation
View remediation
Remediation Suggestions
Remove both read and exec from the tool declaration because the documented advisory functionality does not require them:
yaml
tools: []
Alternatively, omit the tools field entirely if supported by the Skill format.
If a future feature genuinely requires file access, grant a narrowly scoped read-only capability limited to explicitly selected files and directories.
Do not grant general command execution. Introduce a purpose-built, allowlisted operation for any required system interaction instead.
Require explicit user confirmation before accessing local files or performing external side effects.
Enforce host-level sandboxing, path restrictions, command allowlists, argument validation, and execution timeouts independently of Skill instructions.
Treat all user-supplied task content, referenced documents, and cloud file names as untrusted input, and never interpret them as authorization to invoke privileged tools.
Add automated permission review to reject Skill manifests whose declared tools are not directly justified by documented capabilities.
Declaring generic exec for a skill whose stated purpose is guidance about consumer cloud storage gives the skill unnecessary power relative to its described function. In an agent environment, generic execution can be abused to run arbitrary commands, access local files, or pivot beyond the intended advisory scope if later prompts or content trigger tool use.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding
The skill is introduced as a consumer cloud-storage decision assistant, but later advertises broad workflow features such as task orchestration, queue management, monitoring, callbacks, and export. This scope expansion can mislead users and reviewers about the skill's real authority and behavior, increasing the chance that dangerous capabilities are accepted under a benign description.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
The skill states it does not provide concrete API-calling capability, yet it requests API key configuration and also declares exec support. That inconsistency broadens the apparent trust boundary: users may expose secrets or permit execution under the assumption the skill is only advisory, creating avoidable risk from capability confusion and overprivilege.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The storage-cleanup guidance recommends actions like emptying trash and disabling backups without a prominent warning that these steps can permanently delete user data or reduce recoverability. In this context, the skill advises real-world file management decisions, so omission of deletion-risk warnings can directly contribute to irreversible loss.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
80% confidence
Finding
The file-sharing section suggests link sharing and shared folders but does not clearly warn that share links may expose files to unintended recipients, indexing, forwarding, or prolonged access if not revoked. Because this skill targets ordinary consumers, missing privacy guidance makes misuse more likely even if the technical action is common.
