Security audit

content-calibrator

Security checks for vulnerabilities and agentic risk

Overview

This content-scoring skill is mostly coherent, but it sends and retains user content in ways that are not clearly disclosed or tightly scoped.

Review this skill before installing if you may score confidential drafts, customer data, unpublished business material, or regulated content. It relies on external LLM calls and keeps local calibration records, including content previews, so install only if that data handling fits your privacy and retention requirements.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares powerful capabilities (read, exec) and explicitly requires environment variables and Python execution, but there is no clear user-facing permission disclosure or limitation around filesystem, shell, and env access. This increases the risk of over-privileged execution and makes it easier for the skill to read local data or execute commands beyond what a user would reasonably expect.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The function returns the full user-supplied content inside the success payload even though the skill is described as a scoring/calibration tool. That creates unnecessary data propagation to downstream components and increases exposure of sensitive or proprietary text beyond what is needed to compute scores.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The manifest description contains broad trigger phrases such as content scoring, quality prediction, calibration review, and rubric updates, which could cause the skill to activate on overly generic user requests. Overbroad activation is dangerous because it may cause unintended execution of a tool-enabled skill that reads data and sends content to external services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description states that it sources SENSENOVA_API_KEY and SENSENOVA_BASE_URL from the environment and uses external LLM services, but it does not provide a user warning that submitted content may be transmitted off-system. This creates a data exposure risk, especially if users provide sensitive drafts, unpublished content, or internal performance data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends user-provided content and rubric notes to an external LLM provider (sensenova) via llm_chat without any consent gate, warning, or data-minimization step in this file. If users submit sensitive drafts, proprietary content, or personal data, that data is disclosed to a third party and may be logged or retained outside the local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script persists prediction records to disk and includes content_preview derived from user content, creating local data retention without any warning or retention controls in this file. Sensitive or confidential content may remain on disk longer than expected, increasing exposure through backups, shared hosts, or later unauthorized access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code sends user-provided content directly to an external LLM for scoring with no warning, consent check, or sensitivity gating visible in this file. If users submit confidential, personal, or regulated text, that data may be disclosed to third-party model providers unexpectedly.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Returning the original input verbatim in the output payload can propagate secrets, personal data, or proprietary material into logs, orchestration layers, and downstream tools. In a scoring skill, this exceeds the minimum necessary output and increases the blast radius of any sensitive submission.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.