Security audit

completion-report-generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a daily reporting job, but it also under-discloses local cookie/log inspection and writes persistent database notification records.

Review this before installing in a production environment. It needs database authority via PG_DSN and can create or update report and notification rows. It also inspects cookie-file metadata and alert logs that are not clearly disclosed, so install only if those data sources are intended for this reporting job and the notification side effects are acceptable.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill declares only generic tools but requires access to a database DSN, script execution, and behavior consistent with file and possible network access, creating a capability/permission mismatch. When capabilities are broader than declared, operators may approve or deploy the skill without understanding that it can read sensitive local data or reach external resources, which increases the chance of unintended data exposure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is daily report generation, but the observed behavior includes scanning local cookie directories and reading alert_queue.jsonl for unrelated telemetry, which is outside the stated business function. This kind of hidden or weakly documented data collection is dangerous because it can expose credentials, operational state, or user activity from local artifacts that administrators would not expect the reporting skill to access.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill’s declared purpose is daily completion reporting, but it also collects cookie-health, remote guard status, and QR-scan metrics from local files. This is a scope expansion that increases access to unrelated operational data, creating unnecessary data exposure and violating least-privilege expectations for the skill.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The code writes WelcomeBackCard data into the tenant_notification table, which is an active side effect beyond merely generating summaries. Undeclared write behavior can surprise operators, create unauthorized notifications, and turn a reporting job into a message-sending workflow with broader impact.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Reading cookie storage directories is not clearly necessary for a completion-report generator and exposes sensitive operational metadata about authentication artifacts. Even though the code reads file metadata rather than contents, enumerating cookie files and health status can leak environment details and expand the blast radius if the skill is misused.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Parsing alert_queue.jsonl for remote guard status and QR-scan counts gives the skill access to unrelated security/operational logs outside its stated reporting scope. This broadens data access and may expose sensitive event information through derived report outputs or future code changes that log or persist these values more widely.

Missing User Warnings

Medium

Confidence: 76% confidence
Finding: The skill writes aggregated reports and notification records to database tables, but the description does not clearly warn users about these persistent side effects. Undisclosed writes are risky because they can alter production state, trigger downstream workflows, and store potentially sensitive derived data without operator awareness or consent.

Static analysis

No suspicious patterns detected.