Security audit

设计偏好基础版

Security checks across malware telemetry and agentic risk

Overview

This UI preference skill is not overtly harmful, but it asks for more authority than its purpose needs and would build a persistent preference profile with limited controls.

Review before installing. Use this only if you are comfortable with it storing UI design preferences over time, and avoid enabling shell execution or callback delivery unless the agent environment gives you separate controls and you understand what data may be sent or changed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill is presented as a UI design preference learner, but it declares the exec tool, which enables arbitrary command execution unrelated to that stated purpose. This expands the attack surface significantly and can permit filesystem access, process execution, or secret exposure if the agent follows the skill literally or combines it with untrusted input.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Supporting a callback_url introduces outbound data transmission that is not necessary for a local preference-learning skill as described. An attacker or misconfigured workflow could cause user preference data or execution metadata to be sent to external endpoints without meaningful justification or user awareness.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill says it will automatically write confirmed preferences into a profile, but it does not clearly warn that it will persist and modify user data over time. Silent persistence is dangerous because inferred personal preferences may be stored without informed consent, creating privacy, trust, and data-governance risks.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Documenting callback_url without a privacy or data-sharing warning omits a critical disclosure: user-derived preference information may be transmitted to third parties. This can lead to unintentional exfiltration of behavioral or design preference data and makes informed consent impossible.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow explicitly directs the agent to write, read, and remove entries from a preference archive, yet it does not prominently disclose that persistent user data is being modified. Hidden or poorly disclosed state changes can surprise users and create unauthorized profile building over time.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The skill is designed to observe and record user preferences over time into a lasting profile. Even if framed as personalization, this is a form of behavioral data collection that can accumulate sensitive inferences about a user without strong consent, minimization, or retention controls.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The workflow requires tracking repeated signals across interactions and saving inferred preference data after enough observations, which creates persistent profiling behavior. In context, this is more concerning because the skill also has write capability and describes automated confirmation without emphasizing privacy boundaries.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The usage flow explicitly instructs the agent to read, compare, and update a stored preference archive based on ongoing interactions, constituting persistent user profiling. This is risky because repeated inference and stateful updates can reveal patterns about the user beyond the immediate task and may be hard for the user to notice or control.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.