Security audit

数据

Security checks for vulnerabilities and agentic risk

Overview

This data-analysis skill is not malicious, but it asks for broad command and file access while making security-control claims that are not backed by the artifact.

Install only if you are comfortable reviewing each proposed file access, file write, and command before it runs. Do not rely on the skill's encryption, access-control, or command-whitelist claims unless the publisher provides an actual implementation or deployment documentation for those controls.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims encrypted transmission and encrypted storage as established security properties, but the file provides no implementation, configuration, or enforceable mechanism demonstrating those controls. This can mislead users into sending sensitive data under false assumptions, increasing the risk of data exposure or noncompliant handling.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documentation asserts that only whitelisted commands are executed, yet the skill exposes exec capability and contains no visible whitelist policy, validation logic, or execution constraints. In a skill with command execution privileges, this creates a dangerous mismatch that may cause operators to trust a control that does not actually exist, raising the risk of arbitrary command execution or unsafe use of user-controlled input.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation/usage description is extremely broad, covering general data analysis, reporting, insights, and visualization across many scenarios. Because the skill also advertises read, write, and exec tools, overly generic triggering can cause the agent to invoke powerful capabilities in situations where a narrower, safer skill or a simple textual response would suffice.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill exposes read, exec, write, and glob capabilities up front, but the documentation does not prominently warn users that invoking the skill may run commands or modify files. In practice, this reduces informed consent and can lead to accidental destructive actions, data leakage, or system changes when users believe they are only requesting analysis.

Static analysis

No suspicious patterns detected.